Veeam I/O filter for CDP fails to install on ESXi 6.x 

Introduction 

When installing the Veeam Continuous Data Protection (CDP) I/O filter on an ESXi 6.x cluster, the installation may fail with a generic error message that the install failed. 

The Issue 

This can often be caused by a certificate signing issue with older versions of ESXi 6.x. 
Per VMware/Broadcom documentation: https://knowledge.broadcom.com/external/article?legacyId=76555

• ESXi introduced the new certificate for VIB signing into the trust store in 2018 to begin the transition from the old certificate (which expired on 31st December 2019) 
• ESXi hosts running releases before this transition period accept only the old certificate in VIB signature verification 
• As this transition period is now complete, VIB signatures of new releases are untrusted on releases of ESXi prior to this transition, and an upgrade or installation failure would occur 

More details about this issue can sometimes be found in the I_O_filter_deployment.log: 

<13> Error (3) VEE_bootbank_veecdp_12.1.244-1OEM.650.0.0.4598673
<13> Error (3) ('VEE_bootbank_veecdp_12.1.244-1OEM.650.0.0.4598673', 'Could not find a trusted signer.')
<13> Error (3) ; Host issue: Agent VIB module is not installed.

Solutions 

There are two solutions for this issue: 

Solution 1: Upgrade ESXi Version (Recommended) 

VMware recommends upgrading to a later release of ESXi.  Version 7 or 8 have been known to work without issues. 

Solution 2: Manual VIB Installation on ESXi Hosts  

The other solution is to manually install the VIB on the ESXi hosts via SSH and the command line.  It is important to note that the VIB must be installed on all ESXi hosts in each cluster that will be using CDP.  CDP is installed at the cluster level. 

After installing the VIB manually, run the Veeam I/O filter install again; it should already see the I/O filter installed and up-to-date, and it will just run the install process again and it should succeed since the I/O filter is already properly installed. 

To install the VIB manually on an ESXi host, follow these steps: 

1. Locate the VIB files on the Veeam server: 

On the Veeam backup server, in the following directory by default: 

C:\Program Files\Veeam\Backup and Replication\Backup\Packages 

There will be three files that all start with veecdp-offline-bundle: 

• veecdp-offline-bundle – for ESXi 6 
• veecdp-offline-bundle.7.0.0 – for ESXi 7 
• veecdp-offline-bundle.8.0.0 – for ESXi 8 
• Copy the appropriate version (in this case just veecdp-offline-bundle) to each ESXi host in the cluster the I/O filter is being installed on. 

2. Install the VIB via esxcli command line:

SSH into each ESXi host in the cluster and install this VIB using the following command:

esxcli software vib install -d <path to the veecdp file> --no-sig-check

The –no-sig-check tells ESXi to ignore the signature check, which is what is causing the issue with the install from Veeam

3. Rescan and Synchronize Storage Providers in vCenter:

While not usually required, it is recommended to rescan and synchronize storage providers from vCenter.

• Log into vSphere → navigate to Inventory
• Click on vCenter Server (usually at the top of the navigation tree) 
• Go to Configure → Storage Providers
  • Choose to Synchronize Storage Providers
  • Select each ESXi host and choose Rescan

4. Retry the I/O Filter Installation in Veeam:

Return to Veeam and attempt the I/O filter install again.  During the install process, it should see the I/O filter already installed and up-to-date.  Continuing the installation wizard should allow the install process to successfully complete.

Conclusion

Issues with certificate compatibility can prevent the installation of the Veeam CDP I/O filter on older versions of ESXi 6.x.  VMware recommends to upgrade to version 7 or later to correct this; however, if upgrading isn’t possible, the manual VIB installation process should work, allowing the I/O filter to be successfully installed and function correctly.