Domain Authentication Failures in vCenter Server Due to Wildcard Certificates

Products

• VMware vCenter Server
• VMware vCenter Server 8.0

Issue/Introduction

• Domain authentication fails for vCenter Server after a Domain Controller upgrade or certificate change.
• Users observe errors when configuring the identity source using the "Any domain controller in the domain" option.
• Errors similar to "This LDAP connection is not secured" or certificate mismatch errors occur during configuration.
• Verification via CLI shows that the Subject Alternative Name (SAN) contains wildcard entries (e.g., *.domain.com).

Environment

VMware vCenter Server 7.x, 8.x

Cause

vSphere requires certificates to be in compliance with RFC 2253. Wildcard certificates (certificates with * in the Subject or SAN) do not have specific, unique names for the domain controllers they are protecting. vSphere identity sources rely on specific trust relationships and Subject Name validation, which wildcard certificates cannot fulfill.

Resolution

1. Generate new, unique certificates for each domain controller that are RFC 2253 compliant.
2. Ensure each certificate SAN contains the specific FQDN or short name of the respective Domain Controller.
3. Remove the existing, non-compliant identity source configuration from vCenter.
4. Re-add the identity source using the new, compliant certificate chain.
5. Verify the connection status in the vCenter Identity Source configuration menu.

Additional Information

• vSphere Certificate Requirements for Different Solution Paths.
• Wildcard certificates are not supported for vCenter identity source configurations.