Error while trying to import the Machine_SSL certificate in vCenter "Subject Alternate Name (SAN) is empty in the certificate provided"

Products

• VMware vCenter Server

Issue/Introduction

• Error while trying to import the Machine_SSL certificate in the vCenter Server.

[CERTIFICATE] Replace cert Failed: Subject Alternate Name (SAN) is empty in the certificate provided. Please provide a valid vCenter server certificate with a valid SAN field.

• Trying to import certificate using vCert tool, gives the following error message: 

File "/root/vCert-6.x.0-########/operation/manage_certificate.py", line 663, in verify pnid_in san
san_lower = get_subject_alternative_names (cert_x509) .lower () AttributeError: 'NoneType' object has no attribute 'lower'

• The Certificate Signing Request (CSR) was created from a 3rd party application that manages certificates. 
• The Certificate does not contain the Subject Alternative Name (SAN) attribute.

Environment

• vCenter 8.x, 9.x

Cause

• The absence of the SAN (Subject Alternative Name) field in the certificate prevented vCenter from recognizing the certificate, as the SAN is a primary requirement for vCenter certificates.

Resolution

Generate a new CSR from vCenter Server to ensure the CSR is created under standard requirement.

1. To generate CSR using vCenter SSH, refer 1 to 6 steps from KB: Replace vCenter Machine SSL certificate Custom Certificate Authority Signed Certificate
   
   
2. To generate CSR using vSphere client, refer KB: Generate Certificate Signing Request for Machine SSL Certificate Using the vSphere Client