During the deployment of the VCF Management domain via the VCF Installer, the installation fails during the Brownfield VCF Management Services validation phase

Products

• VCF Operations

Issue/Introduction

During the deployment of the VCF Management domain via the VCF Installer, the installation fails during the Brownfield VCF Management Services validation phase. The VCF Installer UI generates an error indicating that the VCF Operations node is unreachable, highlighting a potential network connectivity fault or an invalid Subject Alternative Name (SAN) configuration in the node's SSL/TLS certificate.

The validation failure is verified by the following error message displayed in the VCF Installer user interface: 

Unable to reach VCF Operations node <IP_ADDRESS>. This could indicate a network connectivity issue or a certificate that does not include this address in its SAN field
Remediation: Verify network connectivity to node <IP_ADDRESS> and ensure the VCF Operations certificate includes all node addresses (FQDNs and IPs) in the Subject Alternative Name (SAN) field

Environment

VCF Installer 9.1 

Cause

The VCF Management Services validation engine fails because the VCF Operations certificate contains a structural syntax error in its SAN extension. The validation framework strictly enforces RFC 5280 type matching; when verifying connectivity against an IP address, it parses the certificate's SAN fields specifically looking for an entry of type iPAddress. Because the IP address was compiled into the certificate as a dNSName string entry, the validation check fails to find a valid IP match and flags the node as unreachable or untrusted.

Resolution

1. Regenerate the VCF Operations certificate signing request (CSR) or custom certificate, ensuring that all static IP addresses are explicitly defined under the IP attribute (iPAddress) rather than the DNS attribute (dNSName).
2. Verify that the newly compiled SAN extension contains both the FQDN and the IP explicitly typed: 

   X509v3 Subject Alternative Name:
       DNS:vcf-ops-01.local, IP:<REDACTED_IP_ADDRESS>

3. Import the corrected certificate into the VCF Operations node, restart the management services, and click Retry on the VCF Installer validation screen to proceed with the Management Domain deployment.