Error: "Unable to reach VCF Operations node ####. This could indicate a network connectivity issue or a certificate that does not include this address in its SAN field."

Products

• VMware SDDC Manager / VCF Installer
• VCF Operations

Issue/Introduction

SDDC Manager component installation fails due to a certificate Subject Alternative Name (SAN) validation error. This failure occurs when the validation process identifies that a node within the cluster lacks a certificate that explicitly includes its Fully Qualified Domain Name (FQDN) or IP in the certificate SAN field.




Environment

• VCF 9.1
• VCF Operations 9.1
• SDDC Manager 9.1

Cause

This issue can occur when:

• VCF Operations node FQDN address is omitted from the Subject Alternative Name (SAN) field of the active VCF Operations SSL certificate.
• The active VCF Operations SSL certificate contains an incorrect IP address entry.

Resolution

To resolve this issue update the certificate to include the missing information:

When using a custom certificate:

1. Run the following command to verify that all VCF Operations node FQDN's and IP's are present and are correct (Replacing <VCF_OPS_PRIMARY>):
   

   openssl s_client -connect <VCF_OPS_PRIMARY>:443 </dev/null 2>/dev/null \| openssl x509 -noout -text | grep DNS:

2. Regenerate the VCF Operations certificate ensuring to explicitly include the missing node FQDN or IP address in the Subject Alternative Name (SAN) field during the CSR generation process.
3. Apply the newly generated certificate to the VCF Operations cluster.
4. Re-run the component installation validation in SDDC Manager.

 

When using self signed certificates:

1. Log in to the VCF Operations Admin UI
2. Select the node with the incorrect certificate and click the Shrink Cluster button
3. Use the steps in the wizard to remove the node from the cluster
4. Power off the VM for the removed node and remove it from the vCenter inventory
5. Validate that the PTR record for the node's IP address exists in the DNS server
6. Redeploy the VCF Operations node from ova file and join it to the VCF Operations cluster
7. Log in to the redeployed node and validate that the node's FQDN exists in the certificate SAN

   openssl s_client -connect localhost:443 </dev/null 2>/dev/null \| openssl x509 -noout -text | grep DNS

8. Re-run the component installation validation in SDDC Manager.

Additional Information

When using a custom certificate: Configure a Certificate For Use With VCF Operations

When using self signed certificates: During a VCF Operations appliance's first boot, it performs a reverse DNS lookup for its IP address. It selects the result as its hostname and configures this hostname in the SAN field of the self-signed certificate that is applied to the node. If the reverse DNS lookup fails during the first boot, only DNS: localhost will be included in the self signed certificate's SAN.