Custom Certificate update to SRM and VR is failing with error 'The private key does not match the certificate's public key.'

Products

• VMware Live Recovery

Issue/Introduction

Symptoms:

The error occurred when updating the SRM/VR certificate via the SRM VAMI page.

The following error message was logged:

The private key does not match the certificate's public key.
Operation ID: ##########-####-####-####-############

No CSR/PK generated before this call.
Operation ID: ##########-####-####-####-############

Environment

VMware Live Recovery

Cause

If the certificate replacement failed it is due to the certificate was updated with a PKCS 8 format certificate. However, sometimes this error is a false positive in the GUI.

The SRM and VR only supports PKCS#12 format certificates. 

Resolution

NOTE: The error message in the GUI may just be a GUI error and the certificate may have applied properly. Check to make sure the custom certificate applied properly first by refreshing the page and logging in again.

If the certificate was not replaced, it may need to be changed to PKCS#12 format as shown below:

Convert the PKCS#8 certificate to PKCS#12 format and then SRM and VR certificate update should work.

Command to convert PKCS#8 certificate to PKCS#12 format:

openssl pkcs12 -export -out <output_pkcs12_file> -inkey <pkcs8_private_key_file> -in <certificate_file>