# SSL errors with WebDAV target even with accept all cert option **URL:** \ **Category:** Support\ **Created:** [October 4, 2017, 4:53pm UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904 "2017-10-04T16:53:41Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![drwtsn32](https://forum.duplicati.com/user_avatar/forum.duplicati.com/drwtsn32/32/2591_2.png) [@drwtsn32](https://forum.duplicati.com/u/drwtsn32)\ **Post date:** [October 4, 2017, 4:53pm UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/1 "2017-10-04T16:53:41Z")
I am attempting to back up two Windows 10 computers to a Synology NAS via WebDAV. I have enabled the “accept all certificates” option to see if it would help, but it hasn’t solved the problem. It works maybe 10% of the time, but most of the time it fails with something like: ``` Failed: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. Details: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) --- End of inner exception stack trace --- at Duplicati.Library.Main.BackendManager.List() at Duplicati.Library.Main.Operation.FilelistProcessor.RemoteListAnalysis(BackendManager backend, Options options, LocalDatabase database, IBackendWriter log, String protectedfile) at Duplicati.Library.Main.Operation.FilelistProcessor.VerifyRemoteList(BackendManager backend, Options options, LocalDatabase database, IBackendWriter log, String protectedfile) at Duplicati.Library.Main.Operation.BackupHandler.PostBackupVerification() at Duplicati.Library.Main.Operation.BackupHandler.Run(String[] sources, IFilter filter) at Duplicati.Library.Main.Controller.<>c __DisplayClass16_0.b__ 0(BackupResults result) at Duplicati.Library.Main.Controller.RunAction[T](T result, String[]& paths, IFilter& filter, Action`1 method) ``` Any suggestions? ---
**Author:** ![kenkendk](https://forum.duplicati.com/user_avatar/forum.duplicati.com/kenkendk/32/5305_2.png) [@kenkendk](https://forum.duplicati.com/u/kenkendk)\ **Post date:** [October 5, 2017, 8:17pm UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/2 "2017-10-05T20:17:06Z")
There is a problem with the `--accept-all-ssl-certificates` option in some of the recent canary versions (not the latest and not the beta). What version are you using? There is a similar one here, for HiDrive: > [@"The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel"](https://forum.duplicati.com/t/the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/111): > > Hi guys, I’ve been using Duplicati for several years now, currently Duplicati - 2.0.2.1\_beta\_2017-08-01. I’m using it to back up files to, among other targets, my Strato HiDrive cloud space using WebDAV. A few weeks ago I noticed that often, but not always, Duplicati would abort the backup with the error message “Die zugrunde liegende Verbindung wurde geschlossen: Für den geschützten SSL/TLS-Kanal konnte keine Vertrauensstellung hergestellt werden.” The message is in German because my Windows … ---
**Author:** ![tophee](https://forum.duplicati.com/user_avatar/forum.duplicati.com/tophee/32/21_2.png) [@tophee](https://forum.duplicati.com/u/tophee)\ **Post date:** [October 5, 2017, 8:29pm UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/3 "2017-10-05T20:29:08Z")
Welcome to the forum! I edited your post to improve the formating. (Just added `~~~` before and after the output you pasted, please see [here](https://forum.duplicati.com/t/please-post-screenshots-and-code-blocks-its-very-easy/58?u=tophee) for details). ---
**Author:** ![drwtsn32](https://forum.duplicati.com/user_avatar/forum.duplicati.com/drwtsn32/32/2591_2.png) [@drwtsn32](https://forum.duplicati.com/u/drwtsn32)\ **Post date:** [October 6, 2017, 1:23am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/4 "2017-10-06T01:23:39Z")
I’m running 2.0.2.1\_beta\_2017-08-01. So I technically shouldn’t have this problem as long as I use accept-all-ssl-certificates? (Ultimately i don’t want to use this option and will either use the specific hash match or get a fully trusted cert, but I’m just trying to get it properly working first.) Thank you ---
**Author:** ![JonMikelV](https://forum.duplicati.com/letter_avatar_proxy/v4/letter/j/439d5e/32.png) [@JonMikelV](https://forum.duplicati.com/u/JonMikelV)\ **Post date:** [October 8, 2017, 4:34am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/5 "2017-10-08T04:34:06Z")
Just too confirm you’re having the same issue mentioned earlier, are you also seeing the “underlying connection was closed” error? ---
**Author:** ![drwtsn32](https://forum.duplicati.com/user_avatar/forum.duplicati.com/drwtsn32/32/2591_2.png) [@drwtsn32](https://forum.duplicati.com/u/drwtsn32)\ **Post date:** [October 8, 2017, 5:01am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/6 "2017-10-08T05:01:28Z")
Yep, with SSL enabled I get the underlying connection closed and other error messages most of the time. Occasionally it works, which to me is strange. SSL is currently disabled and it works 100% of the time. ---
**Author:** ![JonMikelV](https://forum.duplicati.com/letter_avatar_proxy/v4/letter/j/439d5e/32.png) [@JonMikelV](https://forum.duplicati.com/u/JonMikelV)\ **Post date:** [October 8, 2017, 5:43am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/7 "2017-10-08T05:43:09Z")
D’Oh! Sorry, I missed the first post where you flat out showed the error. (Stupid phone interface…) ---
**Author:** ![sanderson](https://forum.duplicati.com/letter_avatar_proxy/v4/letter/s/dfb087/32.png) [@sanderson](https://forum.duplicati.com/u/sanderson)\ **Post date:** [October 10, 2017, 1:07am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/8 "2017-10-10T01:07:42Z")
@drwtsn32, did you generate the certificate? If so what method? Have you tried directly trusting the certificate using the hash? ---
**Author:** ![drwtsn32](https://forum.duplicati.com/user_avatar/forum.duplicati.com/drwtsn32/32/2591_2.png) [@drwtsn32](https://forum.duplicati.com/u/drwtsn32)\ **Post date:** [October 10, 2017, 1:22am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/9 "2017-10-10T01:22:34Z")
> [@sanderson](#): > > did you generate the certificate? If so what method? > Have you tried directly trusting the certificate using the hash? I’m using the default cert on my Synology NAS. It is basically a self-signed cert. When I first tried setting this up, I trusted only its hash. I had the problem so I changed it to accept all certs to see if it would help. I could try generating my own cert and trying again with just the hash, if you think it might make a difference. I typically use openssl to generate… RSA 4096-bit w/ SHA256 hash. Let me know if there are any gotchas with the params used to generate a cert. ---
**Author:** ![sanderson](https://forum.duplicati.com/letter_avatar_proxy/v4/letter/s/dfb087/32.png) [@sanderson](https://forum.duplicati.com/u/sanderson)\ **Post date:** [October 10, 2017, 4:06am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/10 "2017-10-10T04:06:56Z")
It might be worth trying to generate your own. If you can export the existing cert and private key it shouldn’t hurt anything to try. I don’t own a Synology so I can’t say, but it seems odd that you can’t even directly trust the certificate. ---
**Author:** ![drwtsn32](https://forum.duplicati.com/user_avatar/forum.duplicati.com/drwtsn32/32/2591_2.png) [@drwtsn32](https://forum.duplicati.com/u/drwtsn32)\ **Post date:** [October 10, 2017, 4:23am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/11 "2017-10-10T04:23:54Z")
Ok I’m gonna generate a new custom cert (still self-signed). Synology is pretty flexible and lets me use that cert for the WebDAV service. Will see if it helps. ---
**Author:** ![drwtsn32](https://forum.duplicati.com/user_avatar/forum.duplicati.com/drwtsn32/32/2591_2.png) [@drwtsn32](https://forum.duplicati.com/u/drwtsn32)\ **Post date:** [October 11, 2017, 3:23am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/12 "2017-10-11T03:23:38Z")
Ok I made a custom self-signed cert, imported into my Synology NAS and bound it to the WebDAV service. It didn’t help. I still get “The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel” at the END of the backup cycle. I tried trusting just the cert fingerprint, and tried allowing all certs. Both have the same result. ---
**Author:** ![JonMikelV](https://forum.duplicati.com/letter_avatar_proxy/v4/letter/j/439d5e/32.png) [@JonMikelV](https://forum.duplicati.com/u/JonMikelV)\ **Post date:** [October 11, 2017, 3:54am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/13 "2017-10-11T03:54:06Z")
I might be misremembering a different issue but could this be related to out of date cert info like we’ve previously seen with mono? ---
**Author:** ![kenkendk](https://forum.duplicati.com/user_avatar/forum.duplicati.com/kenkendk/32/5305_2.png) [@kenkendk](https://forum.duplicati.com/u/kenkendk)\ **Post date:** [October 12, 2017, 11:43am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/14 "2017-10-12T11:43:45Z")
> [@drwtsn32](#): > > I’m running 2.0.2.1\_beta\_2017-08-01. So I technically shouldn’t have this problem as long as I use accept-all-ssl-certificates? There is a known problem in the beta (fixed in latest canary) that the tray-icon runs in the same process as the backup jobs, and uses the same methods. This means that each time the tray-icon performs a request to see if the icon should be updated, it will reset the ssl settings for the running backup. You can either start the trayicon itself with `--accept-any-ssl-certificate` and also set the job up with this, or try the latest canary build. ---
**Author:** ![drwtsn32](https://forum.duplicati.com/user_avatar/forum.duplicati.com/drwtsn32/32/2591_2.png) [@drwtsn32](https://forum.duplicati.com/u/drwtsn32)\ **Post date:** [October 12, 2017, 10:33pm UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/15 "2017-10-12T22:33:22Z")
> [@kenkendk](#): > > You can either start the trayicon itself with --accept-any-ssl-certificate and also set the job up with this, or try the latest canary build. Great, thanks for the info! ---
**Author:** ![drwtsn32](https://forum.duplicati.com/user_avatar/forum.duplicati.com/drwtsn32/32/2591_2.png) [@drwtsn32](https://forum.duplicati.com/u/drwtsn32)\ **Post date:** [October 13, 2017, 2:38am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/16 "2017-10-13T02:38:27Z")
It worked! I was even able to use the option to accept just a specific certificate hash. ---
**Author:** ![JonMikelV](https://forum.duplicati.com/letter_avatar_proxy/v4/letter/j/439d5e/32.png) [@JonMikelV](https://forum.duplicati.com/u/JonMikelV)\ **Post date:** [October 13, 2017, 3:28am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/17 "2017-10-13T03:28:37Z")
> [@drwtsn32](#): > > It worked! Erm…was it the `--accept-any-ssl-certificate` parameter, upgrading to the latest canary (2.0.2.10), or both that worked for you? 🙂 ---
**Author:** ![drwtsn32](https://forum.duplicati.com/user_avatar/forum.duplicati.com/drwtsn32/32/2591_2.png) [@drwtsn32](https://forum.duplicati.com/u/drwtsn32)\ **Post date:** [October 13, 2017, 3:44am UTC](https://forum.duplicati.com/t/ssl-errors-with-webdav-target-even-with-accept-all-cert-option/904/18 "2017-10-13T03:44:32Z")
I’m still running 2.0.2.1\_beta\_2017-08-01 on all the machines. I added the `--accept-specified-ssl-hash` option to the backup set definition and also to the command line for the initial launch of the GUI process. It was that second part that solved it…