Certificate requirements for the Subject Alternative Name (SAN) field in VCF 9.1.1

Products

• VMware vCenter Server

Issue/Introduction

When generating a Certificate Signing Request (CSR) for VCF components, questions arise regarding whether both the FQDN and the IP address are mandatory in the Subject Alternative Name (SAN) field.

Many public Certificate Authorities (CAs) prohibit the inclusion of private (RFC1918) IP addresses in the SAN.

Environment

VMware Cloud Foundation (VCF) 9.1.1
VCF Operations 9.1.1
VCF Automation 9.1.1

Resolution

The CSR must contain the FQDN in the Subject Alternative Name (SAN) field. The IP address is optional.

Note: Including the IP address in the SAN is recommended only if specific integrations rely on IP-based connections to avoid potential hostname verification failures. If such integrations are not present, generating the CSR with only the FQDN is fully supported.

Additional Information

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/fleet-management/certificate-management-9-0.html