VMware Cloud Foundation

Custom SAN Support

The Subject Alternative Name field lets you specify additional hostnames and IP addresses to be protected by a single SSL Certificate. Starting from VCF 4.3, the certificate management module of SDDC Manager supports custom Subject Alternative Names (SAN).


From VCF 3.x onwards, the certificate management module of SDDC Manager was used to generate Certificate Signing Request (CSR) with the predefined SAN fields i.e. the hostname and the IP address of the servers. This solves most of the customer use cases. But, it was not possible to access a server with an alternate DNS name.

User Interface change

The existing ‘Generate CSRs‘ popup was a dialogue box:

The new ‘Generate CSRs‘ popup is a wizard containing additional inputs to accept custom SAN fields:

API changes

In VCF 4.2 or earlier, it was not possible to pass the SAN fields in Generate CSR API. However, starting from VCF 4.3, it is possible to pass the SAN input to the Generate CSR API.

An example of generating CSR with custom SAN with a custom domain name and IP addresses (both IPv4 and IPv6) is shown below:

The below example illustrates a complete workflow on how resource certificates can be replaced with custom SAN fields. In this example, a third-party utility called jq is used.


Step 1: Log in
Step 2: Configure CA
List the domains and resources (optional)
Step 4: Generate CSR
Step 5: Sign the certificates
Step 6: Install Certificates

Final thoughts

It is possible to pass both IPv4 and IPv6 IP addresses. Also, VCF supports wildcard SANs (e.g. *.example.com). However, the downstream products may not support certain types of SAN inputs. Check the individual product documentation for more information.


Related Articles


Leave a Reply

Your email address will not be published. Required fields are marked *