Deploying a NSX Manager or Edge node fails with error: certificate validation failed "no alternative certificate subject name matches target host name".
Article ID: 378849
Updated On:
Products
Issue/Introduction
- When deploying a NSX Manager or Edge node you receive the error: OVF certificate validation failed. Error: Error while fetching ovf file. er: (51) SSL: no alternative certificate subject name matches target host name
- In the NSX Manager logs, you may see the follow entry in the log file /var/log/proton/nsxapi.log
[YYYY-MM-DDTHH:MM:SS] INFO ActivityWorkerPool-1-19 OvfOperator 85672 FABRIC [nsx@6876 comp="nsx-manager" level="INFO" subcomp="manager"] Error occurred :: com.vmware.nsx.management.ovfops.exception.CertificateManifestValidationError: OVF certificate validation failed. Error: Error while fetching ovf file. er: (51) SSL: no alternative certificate subject name matches target host name '<FDQN>'
Note: If this KB does not match your issue, these are similar new issues that may match
"OVF certificate validation failed. Error: [VALIDATION_ERROR: CERTIFICATE_EXPIRED; ]" error for NSX Edge Install/Redeploy/Resize
"OVF certificate validation failed. Error: [VALIDATION_ERROR: CERTIFICATE_EXPIRED; ]" error for NSX Manager deployment
Environment
VMware NSX-T Data Center
VMware NSX
Cause
The certificate common name (or Subject Alternative Name) applied to the node(s) is incorrect or may not be assigned to the specified FQDN of the Manager node(s).
Resolution
Correct the certificate so that the common name matches the FQDN applied to the node or there is a Subject Alternative Name entry with the FQDN.
Ensure that there are NSX API certificates for the controllers are present and their subject alternative names are correct for a successful deployment.
Additional Information
Feedback
