Import a vCenter Precheck Fails with NSX Manager Certificate Subject Alternative Name Mismatch.

Products

• VCF Operations

Issue/Introduction

When attempting to import a vCenter Add "Validation Failed", "VCF 9.x Brownfield via the user interface path VCF Operations > Operate > Inventory > VCF Instances > ADD WORKLOAD DOMAIN, the execution fails during the precheck validation phase.

• • 9 Errors, all seem related to NSX:
    
    

• The following error signatures are logged within operationsmanager/operationsmanager.log:
  

  YYYY-MM-DDThh:mm:ss.643+0000 ERROR [vcf_om,6a3cf3f62d246ea95c8c683ea1a21f52,8a42] [c.v.e.s.c.c.CertificateRetrustService,pool-2-thread-20] Failed to retrust with the server https://<REDACTED_HOSTNAME>/certificate-management/certificate-bundle, error Unexpected character ('<' (code 60)): expected a valid value (JSON String, Number, Array, Object or token 'null', 'true' or 'false')

  YYYY-MM-DDThh:mm:ss.643+0000 ERROR [vcf_om,6a3cf3f62d246ea95c8c683ea1a21f52,8a42] [c.v.v.c.n.s.c.c.NsxtConnectionFactory,pool-2-thread-20] Failed to perform the retrust operation with the server: <REDACTED_HOSTNAME>

  YYYY-MM-DDThh:mm:ss.643+0000 ERROR [vcf_om,6a3cf3f62d246ea95c8c683ea1a21f52,8a42] [c.v.e.s.c.v.primitive.NsxtValidator,pool-2-thread-20] Failed to validate NSX <REDACTED_HOSTNAME> connectivity

  com.vmware.vapi.client.exception.SslException: Certificate for <REDACTED_HOSTNAME> doesn't match any of the subject alternative names: [<REDACTED_HOSTNAME_SHORT>]
Caused by: javax.net.ssl.SSLPeerUnverifiedException: Certificate for <REDACTED_HOSTNAME> doesn't match any of the subject alternative names: [<REDACTED_HOSTNAME_SHORT>]


Environment

VMware Cloud Foundation 9.x

Cause

• The certificate presented by the NSX Manager Management Cluster Virtual IP (VIP) endpoint contains a mismatch. When VMware Cloud Foundation attempts to validate the Fully Qualified Domain Name (FQDN) of the NSX Manager cluster, it cross-references the requested FQDN against the certificate's Subject Alternative Name (SAN) field.
  
  
• If the certificate assigned to the cluster VIP only includes the short name or an incorrect identifier (e.g., [<REDACTED_HOSTNAME_SHORT>]) instead of the complete FQDN, the underlying vAPI client throws an SslException and halts the domain deployment or configuration workflow.
  

 

Resolution

To resolve this issue, all node FQDNs plus the VIP FQDN must be in the SAN.

1. Log in to the NSX Manager user interface with administrative privileges.
   
   
2. Navigate to System > Certificates.
   
   
3. Locate the misconfigured certificate currently assigned to the Management Cluster VIP.
   
   
4. Select the target certificate row, click Actions, and select Replace Certificates.
   
   
5. Within the Replace Certificates dialog window, select the appropriate provisioning option based on your certificate authority requirement:
   
   
   • Import Certificates: Select this to upload a newly signed CA certificate containing the proper SAN entries.
     
     
   • Generate Self Signed Certificate: Select this to define and issue a new self-signed certificate.
     
     
6. Ensure that the new certificate explicitly defines the cluster FQDN within the Subject Alternative Name field.
   
   
7. Click Save to apply the configuration and re-run the VCF Workload Domain precheck.

Additional Information

For comprehensive guidance regarding alternative certificate replacement techniques, see Replace Certificates Through NSX Manager.