"Replace cert Failed: Subject Alternate Name (SAN) is empty in the certificate provided", error while trying to import the Machine SSL certificate in vCenter Server.

Products

• VMware vCenter Server

Issue/Introduction

• When attempting to replace the Machine SSL certificate via the vSphere Client Certificate Management tab, the operation fails with the following error:

[CERTIFICATE] Replace cert Failed: Subject Alternate Name (SAN) is empty in the certificate provided. Please provide a valid vCenter server certificate with a valid SAN field.

• Additionally, vCert tool imports may fail with: AttributeError: 'NoneType' object has no attribute 'lower' in verify_pnid_in_san
  
  

File "/root/vCert-6.x.0-########/operation/manage_certificate.py", line 663, in verify pnid_in san
san_lower = get_subject_alternative_names (cert_x509) .lower () AttributeError: 'NoneType' object has no attribute 'lower'

Environment

• VMware vCenter Server 8.x
• VMware vCenter Server 9.x

Cause

The vCenter Server Primary Network Identifier (PNID), typically the FQDN, is missing from the Subject Alternative Name (SAN) extension of the certificate being imported. This can also occur if the certificate chain (Root/SubCA) is incorrectly pasted into the Machine SSL certificate field, as CA certificates do not typically contain SAN fields.

This can be verified by opening the certificate from Windows desktop and look for 'Subject Alternative Name' field under the Details tab as below:

Resolution

To resolve this issue, ensure the certificate contains the correct PNID and is placed in the correct UI field.

1. To generate CSR using vSphere Client, refer Generate Certificate Signing Request for Machine SSL Certificate Using the vSphere Client.
   • Enter the vCenter Server FQDN for the Subject Alternative Name field during CSR generation.
     
     
2. To generate CSR using vCert tool, refer vCert - Scripted vCenter expired certificate replacement.
   • Use the Menu options - 3. Manage certificates ->  1. Machine SSL certificate ->  2. Replace Machine SSL certificate with a custom CA-signed certificate ->  1. Generate Certificate Signing Request and Private Key
     
     
3. To generate CSR using vCenter Certificate Manager CLI, refer 1 to 6 steps from KB Replace vCenter Machine SSL certificate Custom Certificate Authority Signed Certificate.

Note: Use the same tool while replacing the certificate. For example, if the CSR is generated from vSphere Client, use only vSphere Client during Certificate import.