NSX LDAPS authentication fails with hostname mismatch error

Products

• VMware NSX

Issue/Introduction

• The NSX LDAPS servers connectivity shows as failed in the NSX UI under User Management > Identity Providers.
• When testing the connection via the NSX UI, the following error is displayed: hostname configured for ldap server does not match the hostname in servers certificate subject or SAN

Below is the screenshot of the error:
  


Environment

VMware NSX

Cause

The LDAPS servers were originally added to the configuration using IP addresses. The certificate presented to NSX does not have the LDAPS server IP addresses listed as a Subject Alternative Name (SAN) and because the IP address does not match the expected hostname in the certificate, the connection is rejected.

Resolution

To resolve this issue, reconfigure the LDAPS servers using their Fully Qualified Domain Name (FQDN):

1. Log in to the NSX UI.

2. Navigate to User Management > Identity Providers.

3. Remove the existing LDAPS servers that are currently configured with IP addresses.

4. Re-add the LDAPS servers using their exact FQDN instead of IP addresses.

5. Save the configuration and verify that the connection status now shows as successful.

If the issue persists even after following the above steps, please open a case with Broadcom support team.