Secondary LDAPS URL displays Root CA certificate instead of leaf certificate in VMware Cloud Foundation

Products

• VMware vCenter Server 8.0

Issue/Introduction

This article provides guidance on configuring Active Directory over LDAPS as an Identity Source in VMware Cloud Foundation (VCF) and explains observed certificate visibility behaviors in configuration utilities such as sso-config.sh

When reviewing the Identity Source configuration using the sso-config.sh utility, the secondary Domain Controller URL may display the Root CA certificate (Trust Anchor) instead of the server leaf certificate, even if authentication failover is functioning correctly.

Environment

• VMware Cloud Foundation 5.x
• VMware vCenter Server  8.x

Cause

This behavior occurs when the Identity Source is configured by trusting the signing certificates (Root and Intermediates) rather than individual server leaf certificates.

In VCF, there are two methods to establish trust:

1. Trusting the individual leaf certificate of the server.
2. Trusting the signing certificates (Root and Intermediates) that issued the leaf certificates.

Broadcom recommends associating identity providers with the Root CA and Intermediates to ensure broader trust and simplify certificate rotation.

Resolution

The observed behavior is expected. Authentication failover functions correctly as long as the Root CA signing certificate is present, as it allows the Identity Provider to validate requests from any DC signed by that CA.

If the server leaf certificate must be displayed for auditing reasons:

1. Log in to the vSphere Client as an SSO Administrator.
2. Navigate to Administration > Configuration > Identity Sources.
3. Delete the existing Identity Source.
4. Re-add the Identity Source, explicitly mapping the individual leaf certificate for each Domain Controller URL.

Note: Re-adding the Identity Source may cause temporary authentication downtime for users of that provider during the reconfiguration.

Additional Information

• For general LDAPS configuration steps, see Single Sign-On Identity Source configuration using LDAPS in vSphere Client
• To download VCF patches or software, visit the Broadcom Support Portal