ESXi host client login fails with NET::ERR_CERT_COMMON_NAME_INVALID error

Products

• VMware vSphere ESXi

Issue/Introduction

• The ESXi SSL certificate is replaced with a custom CA-signed certificate.
• When attempting to log in to the ESXi host client via a web browser, the connection is blocked, displaying the following error message:
  
  Your connection is not private  
NET::ERR_CERT_COMMON_NAME_INVALID
  

Environment

VMware vSphere ESXi 8.x

Cause

The Common Name (CN) and Subject Alternative Name (SAN) fields are not configured during the generation of the Certificate Signing Request (CSR), which triggers the common name invalid error in the web browser.

Resolution

To resolve the issue, regenerate the certificate ensuring all identity fields are present:

1. Configure the openssl.cfg file as detailed in Configuring OpenSSL for installation and configuration of CA signed certificates in the vSphere environment. 
2. Generate the new CSR by executing the following command：
   
   openssl req -new -nodes -out rui.csr -keyout rui-orig.key -config openssl.cfg
   
   
3. Provide the rui.csr to the Certificate Authority (CA) to receive the new certificate.
4. Import the certificate to the ESXi host. For detailed instructions, refer to the KB: Configuring CA signed certificates for ESXi hosts.