HTTP 503 Due to "Server certificate verification failed: hostname did not match with upstream certificate"

Products

• VMware Avi Load Balancer

Issue/Introduction

• Client requests to the Virtual Service fail with HTTP 503 responses.
• The Virtual Service traffic log shows the following significance message: "Server certificate verification failed: hostname did not match with upstream certificate"
  

Environment

• VMware AVI Load Balancer

Cause

• The Pool SSL configuration has "Enable Common Name Check" enabled under Applications > Pools > <Pool Name> > SSL.
  
• When no explicit domain name is configured, Avi uses the incoming client Host header for backend server certificate validation.
• The client Host header can be verified from Applications > Virtual Services > <VS Name> > Logs > Headers.
  
• The Host header does not match the Common Name (CN) in the backend server certificate, causing certificate validation to fail and resulting in an HTTP 503 response.

Resolution

• Use one of the following options to resolve the issue:

  1. Configure the client to send a Host header that matches the Common Name (CN) in the backend server certificate.

  2. Configure a hostname under Applications > Pools > <Pool Name> > SSL > Domain Names that matches the Common Name (CN) in the backend server certificate.

     • Avi uses the configured domain name for backend server certificate validation instead of the incoming client Host header.
       

     • The configured domain name must match the Common Name (CN) specified in the backend server certificate. Run the following command on the backend server to verify the Common Name (CN) configured in the certificate.
       

  3. Disable Enable Common Name Check under Applications > Pools > <Pool Name> > SSL if hostname validation is not required..