Error: "Subject Alternate Name (SAN) field does not contain the PNID. Please provide a valid certificate" - VMware vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• When attempting to replace the machine SSL certificate of a vCenter Server Appliance (VCSA) with a new CA-signed certificate, using the certificate manager utility, the operation fails with the following error message:

  Error: Subject Alternate Name (SAN) field does not contain the PNID. Please provide a valid certificate
  
  Status : 0% Completed [Operation failed, performing automatic rollback]

• In /var/log/vmware/vmcad/certificate-manager.log the following messages are reported:

  YYYY-MM-DDTHH:MM:SS INFO  certificate-manager  Running command : ['/usr/lib/vmware-vmafd/bin/vmafd-cli', 'get-pnid', '--server-name', 'localhost']
  YYYY-MM-DDTHH:MM:SS INFO  certificate-manager  Output : <correct PNID of vCenter>
  ..
  YYYY-MM-DDTHH:MM:SS ERROR certificate-manager  Error: Subject Alternate Name (SAN) field does not contain the PNID. Please provide a valid certificate
  YYYY-MM-DDTHH:MM:SS ERROR certificate-manager  Error while replacing Machine SSL Cert, please see /var/log/vmware/vmcad/certificate-manager.log for more information.

Environment

• VMware vCenter Server 7.x
• VMware vCenter Server 8.x
• VMware vCenter 9.x

Cause

This issue occurs when the new SSL certificate is missing the Primary Network Identifier (PNID) in the Subject Alternative Name field. vCenter validates that the PNID must be present in the SAN to ensure the certificate is valid for its configured hostname.

Resolution

In order to prevent this issue:

• Confirm the current PNID using the following command:

  # /usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost

• Generate a new certificate signing request using certificate-manager which includes the correct PNID in the Hostname field.

  Note: Multiple hostnames(comma-separated) can be entered, however the PNID of vCenter must be present in the hostnames.

Additional Information

Refer to the following documents for steps to replace the machine SSL certificate of a vCenter Server Appliance:

1. Custom Machine SSL certificate replacement on vCenter
2. Machine SSL Certificate Replacement