According to here - Architecture Overview - Veeam Disaster Recovery Orchestrator User Guide there is an agent that gets deployed to your VBR servers to orchestrate recovery so that would mean that the vCenter connection and certs should be confirmed there like you did.  I know it uses the built-in VBR/VONE but still connects to VBR.

Thanks Chris for your reply. 

I agree with you that the connections to the vCenters from the built-in VBR should be confirmed after the cert change on the vCenters but I think that DRO should have made that confirmations once the connections have been refreshed from the DRO side instead of doing another manual step of bringing up the built-in VBR console and doing the refresh.

I agree with your thinking that really this sort of error should be passed back to VRO for you to remediate within the web GUI.

Speaking potentially a bit harshly of the product, a lot of what VRO does, feels like it’s running PoSH & API calls against VBR & VONE, instead of native functionality. That’s fine if it wants to use those as its backend, but errors should certainly still be presented back to the front-end for resolution.

I’d suggest raising this in the R&D forums (forums.veeam.com) to get product management aware of this in case it’s a bug, and as a feature improvement if it’s not.

Thanks for the suggestion of bringing this to forums.veeam.com.  I will update if I get anything significant from them.

Per forums.veeam.com, they will take this up with development and see if implementation without going to the built-in VBR and VONE would be possible. Thanks!