VMware is aware of this issue.
Currently, there is no resolution.
Workaround:
To workaround this issue, use one of these options
Workaround 1
Ensure the Common Name (CN) matches with the PNID while generating the certificates.
OR
Workaround 2
- Generate new certificates where both DNS and IP contains only 1 value.
Example: DNS only contains test.example.com and also CN is also modified to test.example.com
- Replace the Machine SSL Certificate in VCSA 6.7 U3 and perform upgrade to 7.0.