Cluster SSL Certificate

Hi Thibaut,

The easiest solution would be either a single wildcard certificate, or a SAN certificate which contains your CVM and Cluster VIP hostnames as Subject Alternative Names - that way you apply one certificate consistently across all your nodes.
By default your CVM's ship with a self-signed wildcard certificate for *.nutanix.local. Nutanix recommends replacing this with a CA-signed certificate (a wildcard is the most straightforward). The public documentation for SSL cert replacement is located here (link below), and it includes a list of supported certificate configurations and a breif how-to:

https://portal.nutanix.com/#/page/docs/details?targetId=Web_Console_Guide-NOS_v4_1:wc_security_ssl_certificate_wc_t.html

I will try to install 1 certificate that has CN the cluster FQDN with associated SAN certificates which contains the CVM FQDN and I will keep you updated.

Thank you.

Thibaut

Just keep in mind that a SAN certificate is going to add some complexity as you expand your cluster. You'll need to keep adding another SAN to the cert every time you add an additional node, whereas a wildcard would be one-and-done from a future-proof perspective.