6.1

Table Of Contents
n
The certificate must be a server certificate, for which the x509v3 Extended Key Usage must indicate TLS
Web Server Authentication.
n
The certificate must include an extendedKeyUsage or enhancedKeyUsage attribute, the value of which
is serverAuth.
n
Unlike in 5.x releases, there is no requirement for the certificate to also be a client certificate. The
clientAuth value is not required.
n
The Subject Name must not be empty and must contain fewer than 4096 characters. In this release, the
Subject Name does not need to be the same for both members of a Site Recovery Manager Server pair.
n
The certificate must identify the Site Recovery Manager Server host.
n
The recommended way to identify the Site Recovery Manager Server host is with the host's fully-
qualified domain name (FQDN). If the certificate identifies the Site Recovery Manager Server host
with an IP address, this must be an IPv4 address. Using IPv6 addresses to identify the host is not
supported.
n
Certificates generally identify the host in the Subject Alternative Name (SAN) attribute. Some CAs
issue certificates that identify the host in the Common Name (CN) value of the Subject Name
attribute. Site Recovery Manager accepts certificates that identify the host in the CN value, but this
is not the best practice. For information about SAN and CN best practices, see the Internet
Engineering Task Force (IETF) RFC 6125 at https://tools.ietf.org/html/rfc6125.
n
The host identifier in the certificate must match the Site Recovery Manager Server local host
address that you specify when you install Site Recovery Manager.
n
If Site Recovery Manager Server, vCenter Server, and Platform Services Controller run on the same host
machine, you can use the same certificate for all three servers. In this case, you must provide the
certificate in two formats:
n
For Site Recovery Manager, the certificate must be a Personal Information Exchange Format
(PKCS#12) certificate that contains both of the private and public keys.
n
For vCenter Server and Platform Services Controller, the certificate must be separated into two
files, one for the certificate with the public key and one for the private key. For information about
certificate requirements for vCenter Server and Platform Services Controller, see vSphere Security
Certificates in the vSphere 6.0 documentation.
n
If you use a custom certificate that is signed by a third-party CA for which the root certificate is not
registered by default in Windows, and you want the certificates to be trusted without the need for
thumbprint verifications, install the root CA certificate in the Windows certificate store.
Site Recovery Manager Installation and Configuration
26 VMware, Inc.