Unable to attach a certificate to the Virtual Service (VS)

Products

• VMware Avi Load Balancer

Issue/Introduction

• After creating a Certificate Signing Request (CSR) and importing the signed certificate into Avi Controller, the new certificate is not visible in the dropdown list when attempting to attach it to a Virtual Service (VS).

Cause

This issue typically occurs if the certificate was not generated as an Application Certificate (Virtual Service type).

Avi UI allows three types of certificate/csr creations: 

1. Controller Certificates: Used exclusively for the Avi management GUI/CLI access.
2. Application Certificates: Used for securing traffic on Virtual Services.
3. Root/Intermediate CA certificates: Used for root and intermediate certificates.

For virtual service consumption, the certificate should be an application certificate. 

To check the certificate type, you can use the command : > show sslkeyandcertificate <cert name> | grep type. 

Sample screenshot below : 

 

Resolution

To resolve this, you must generate a new CSR or certificate specifically for application use. 

Reference Techdoc: SSL-certificates