Workload domain Import into VCF Operations fails with error "Validation Failed"

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

Upon trying to import a WLD with NSX already configured it fails with "Validation Failed" error: 

On SDDC Manager /var/log/vmware/vcf/operationsmanager/operationsmanager.log: 

2026-06-03T14:44:40.045+0000 DEBUG [c.v.e.s.c.v.primitive.NsxtValidator,pool-2-thread-18] Validating NSX credentials <nsx_manager_vipFQDN>
2026-06-03T14:44:40.054+0000 INFO  [c.v.e.s.c.c.CertificateRetrustService,pool-2-thread-18] Attempting a retrust from the endpoint https:/<nsx_manager_vipFQDN>/certificate-management/certificate-bundle
2026-06-03T14:44:40.088+0000 ERROR [c.v.v.c.n.s.c.c.NsxtConnectionFactory,pool-2-thread-18] Failed to perform the retrust operation with the server: <nsx_manager_vipFQDN>
2026-06-03T14:44:40.093+0000 DEBUG [c.v.e.s.c.v.primitive.NsxtValidator,pool-2-thread-18] Failed to validate NSX <nsx_manager_vipFQDN> connectivity
com.vmware.vapi.client.exception.SslException: Certificate for <nsx_manager_vipFQDN> doesn't match any of the subject alternative names: [<nsx_managerFQDN1>, <nsx_managerFQDN2>, <nsx_managerFQDN3>]
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.verifyHostname(SSLConnectionSocketFactory.java:507)
at com.vmware.vapi.internal.protocol.client.rpc.http.ApacheClientRestTransport.execute(ApacheClientRestTransport.java:107)
at com.vmware.evo.sddc.common.validation.primitive.NsxtValidator.checkNsxTCredentials(NsxtValidator.java:70)

Environment

VMware Cloud Foundation 9.x 

VMware Cloud Foundation 9.1

Cause

The SSL certificate assigned to the NSX Manager cluster does not include the cluster Virtual IP (VIP) FQDN in its Subject Alternative Name (SAN) field. SDDC Manager's strict hostname verification rejects the connection when it targets the VIP but the certificate only covers individual nodes.

Resolution

Update NSX Manager Certificate

• You must reissue and apply a new SSL certificate to the NSX Manager cluster that includes all required identifiers in the SAN field:
  - Individual FQDNs for all NSX Manager nodes (e.g., ####01.####, ####02.####, ####03.####.) and the cluster VIP FQDN (e.g., ####.####).

Ensure port 443 is not blocked on the Managers: 

Run the following commands from the SDDC Manager appliance to confirm reachability and DNS resolution:

1. Check reachability to the cluster VIP vs. each individual node on port 443
   nc -vz <nsx-vip-fqdn> 443
nc -vz <nsx-node01-fqdn> 443
nc -vz <nsx-node02-fqdn> 443
nc -vz <nsx-node03-fqdn> 443
2. Confirm DNS resolves each node FQDN to its correct management IP
   getent hosts <nsx-node01-fqdn>
getent hosts <nsx-node02-fqdn>
getent hosts <nsx-node03-fqdn>