LDAPS check status Fails with CHECK Subject Alternative Name in Certificate

Products

• VMware NSX

Issue/Introduction

• While configuring NSX for LDAPS, you receive an error stating that you need to check the Subject Alternative Name field of the cert to verify the connection.
• One of the below items will also be observed:
  
  • You have configured LDAPS using the IP address, but the certificate only contains the FQDN.
  • You have configured LDAPS using the FQDN, but the certificate only contains the IP address. 
  • You have configured LDAPS using an alternate name that is not listed in the SAN or the Common Name (CN) of the cert.

 

 

Environment

VMware NSX

Cause

The connection URI needs to match the name in the Cert, either the CN, or the SANs. If the cert is only for the IP or ONLY for the FQDN, that is what you need to use for your LDAPS connection string.

 

 

Resolution

To resolve the issue, follow one of the two options below:

1. Set your LDAPS connection to match what the cert shows.
2. Re-create the cert with all the appropriate SAN's so no matter how the connection is referred to, it will be accepted.