SDDC Manager Microsoft CA Connection Fails Due to SAN Validation Error

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

When attempting to connect to the Active Directory Certificate Services (AD CS) endpoint (e.g., https://<ad_cs_fqdn>/certsrv) during Microsoft CA configuration in SDDC Manager (Security > Certificate Authority > Microsoft CA), the connection fails with a certificate validation error.

Environment

• Product: SDDC Manager 9.1.1

Cause

SDDC Manager enforces modern TLS validation standards starting in version 9.1.1, which strictly require a Subject Alternative Name (SAN) extension in server certificates. While older certificate configurations relied primarily on the Subject Common Name (CN), modern security guidelines mandate the SAN attribute to validate the target endpoint's FQDN. The Active Directory Web Server certificate currently presented by the domain endpoint lacks the SAN extension, causing SDDC Manager to reject the TLS handshake.

Resolution

To resolve this issue, update the TLS web server certificate bound to your Active Directory Web Server / Certificate Services IIS site to include the required SAN extension.

1. Request a new Web Server certificate from your Active Directory Certificate Authority (AD CA) using a certificate template configured to include the Subject Alternative Name (SAN) attribute containing the FQDN of the endpoint.
2. Replace the existing certificate on the AD CS web server with the newly issued SAN-enabled certificate.
3. Return to SDDC Manager and re-attempt the Microsoft CA configuration in Security > Certificate Authority > Microsoft CA.