Operation failed: The private key does not match the certificate's public key in VMware Live Recovery Appliance.

Products

• VMware Site Recovery Manager

Issue/Introduction

This article provides steps to troubleshoot certificate configuration errors in VMware Live Recovery (VLR), specifically addressing the "The private key does not match the certificate's public key" error when importing CA-signed certificates.

When attempting to import a CA-signed certificate via the VAMI, the following error is encountered:

Symptoms

• "Operation Failed: The private key does not match the certificate's public key."
• The VAMI GUI may prevent CSR generation without an IP address, which may not align with organizational security policies.

Environment

VMware Live Recovery (VLR) 9.0.5

Cause

This error occurs because the CA-signed certificate was not generated from the active Certificate Signing Request (CSR) associated with the private key on the appliance.

This is typically due to multiple CSR attempts or CA portal caching issuing an older certificate.

Resolution

1. Generate a new CSR and Private Key: Generate the CSR using the command line to avoid VAMI GUI restrictions: 
   
openssl req -new -nodes -newkey rsa:2048 -keyout vlsr.key -out vlsr.csr -subj "/C=##/ST=##/L=######/O=####/OU=###/CN=####.####.#######.###" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf; printf "\n[SAN]\nsubjectAltName=DNS:####.####.########.###")

2. Submit the CSR to the CA: Submit the newly generated vlsr.csr to your internal Certificate Authority. Ensure you clear any browser cache or force a "New Request" in the CA portal to prevent the issuance of a cached certificate.

3. Verify the Cryptographic Pair: Before importing, verify that the private key and the new certificate match by checking the modulus hashes:

   • Verify Private Key: openssl rsa -noout -modulus -in vlsr.key | openssl sha256
   • Verify Certificate: openssl x509 -noout -modulus -in [new_certificate].crt | openssl sha256
   • Note: If the hashes do not match, the certificate is not valid for this private key.

4. Import the Certificate: Once verified, proceed with the import process. If additional steps are required, refer to the product documentation.

Additional Information

Reference KB article: Configuring CA signed certificates for SRM, VLSR/or VRMS/or VRS 

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.