If you have installed SSL certificates issued by a trusted certificate authority (CA) on the vCenter Servers that support SRM, the certificates you create for use by SRM must meet the following criteria:
Note: If you are using additional fields in a SSL certificate such as C, S, or, L, these values must also match on both sides.The combined length of the subject name cannot exceed 80 bytes. The Subject Name includes the values you supplied for CN, O, and OU, as well as a description (such as “CN=”), for example, if you entered “SRM”, “Example Corp.”, and “example.com” as the values for CN, O, and OU respectively, the actual Subject Name would look like this:
O=Example Corp/OU=example.com/CN=SRM
SRM requires that all of these attributes be present in the Subject Name. Your certificate may include additional attributes in the Subject Name, but the set of included attributes and their values must be identical for both certificates. The number of bytes in this string is determined by the encoding of the characters. Because some characters might be encoded as more than one byte, verify the length of the encoded Subject Name by using the following command:
openssl.exe x509 -in path-to-certificate-in-PEM-format -subject
Note: This command works only if the SRM certificates are in the PKCS#12 format. If the certificates are not in the PEM format, run this command to verify the subject fields:If customer does not have openssl installed, they can use openssl that ships with SRM located by in the bin folder in the SRM installation directory (C:\Program Files\VMware\VMware vCenter Site Recovery Manager\bin by default).
openssl.exe pkcs12 -in path-to-certificate-in-PEM-format -nokeys -password pass:<certificate password>
-clcerts | openssl x509 -noout -subject
If you are using a Microsoft CA, see the Microsoft article 931351 for information on how to set the Subject Alternative Name.
Note: The preceding link was correct as of April 24, 2014. If you find the link is broken, provide feedback and a VMware employee will update the link.