VCP-VCF Administrator 2024 Question 38
Single answerYou are tasked with configuring certificate management for a VMware Cloud Foundation (VCF) deployment. The organization requires the use of custom certificates issued by their internal Certificate Authority (CA) for all VCF components. After importing the custom certificates into the SDDC Manager, you encounter an error when attempting to apply them to the workload domain. What is the most likely cause of the issue?
- A
The custom certificate's Subject Alternative Name (SAN) field is missing required DNS entries.
- B
The custom certificate's private key was not exported in PKCS #12 format.
- C
The custom certificate is not signed using the SHA-2 algorithm.
- D
The custom certificate's validity period exceeds the maximum allowed validity in VMware Cloud Foundation.
Show answer and explanation
Correct answer: A
Explanation
In VMware Cloud Foundation, the Subject Alternative Name (SAN) field in custom certificates must include all required DNS entries, such as the fully qualified domain names (FQDNs) of the workload domain components. If the SAN field is incomplete, the certificate validation process will fail when applied to the workload domain. Always ensure SAN entries are properly configured when issuing custom certificates in VCF environments.
- A. Correct.
The Subject Alternative Name (SAN) field must include all required DNS entries (e.g., FQDNs of VCF components). Missing SAN entries can cause certificate validation failures.
- B. Incorrect.
While the private key format is important, VMware Cloud Foundation does not require PKCS #12 specifically for private key export. This is not the most likely cause in this scenario.
- C. Incorrect.
VMware Cloud Foundation supports certificates signed with the SHA-2 family of algorithms. An issue with the signing algorithm would typically result in a different error.
- D. Incorrect.
VMware Cloud Foundation does allow certificates with long validity periods, as long as they meet the minimum and maximum requirements. This is unlikely to be the cause of the error.