Hyper V Replica Cross Site Cross Domain certificate issue

-

hello, i've issued san certificates both primary server (domain1) , replica server (domain2) enterprise ca , replication these certificates works fine if use internal name of replica server when enabling replication on specific vm.  if change name of replica server public address though "servername.dyndns.org"  (using dyn cheap external access testing) in order try replication on wan following errors.  same certificates , configuration work fine local name.  have of internal , external names on certificate subject alternative names, i've imported ca certificate the trusted root store of primary server, have hyper v replica open on firewall, , forwarding 443 through external firewall well.  help!

 

enabling replication failed.

hyper-v failed enable replication.

hyper-v received digital certificate not valid replica server
servername.dyndns.org.

hyper-v failed enable replication virtual machine new virtual machine’:
specified certificate self signed.

(0x80092007).
(virtual machine id obf44cbd-o8af-4430-bsbf-fbfc3eo13f8d)

hyper-v received digital certificate not valid replica server
‘servername.dyndns.org’. error: specified certificate self signed. (0x80092007).


hi,

according description, seems certificate issue.

check whether have configured certificate correctly:

to enable server receive replication traffic, certificate in replica server must meet following conditions

  • enhanced key usage must support both client , server authentication
  • set subject field or subject alternative name using 1 of following methods:
    • for san certificate, set subject alternative name’s dns name replica server name (e.g.: replica1.contoso.com). if replica server part of cluster, subject alternative name of certificate must contain replica server name *and* fqdn of hvr broker (install certificate on nodes of cluster.)

(or)

    • set subject field replica server name (e.g.: replica1.contoso.com). if replica server part of cluster, ensure certificate subject field set fqdn of hvr broker installed on nodes of cluster.

(or)

    • subject field can contain wildcard (e.g.: *.department.contoso.com)
  • ensure valid x.509v3 certificate not revoked.
  • check if root of certificate present in “trusted root certification authorities” of replica server certificate store.

for more information please refer following ms articles:

hyper-v replica - prerequisites certificate based deployments
http://blogs.technet.com/b/virtualization/archive/2012/03/13/hyper-v-replica-certificate-requirements.aspx
hyper-v replica–certificate based authentication in windows server 2012
http://blogs.technet.com/b/virtualization/archive/2012/07/16/hyper-v-replica-certificate-based-authentication-in-windows-server-2012-rc.aspx
requesting hyper-v replica certificates enterprise ca
http://blogs.technet.com/b/virtualization/archive/2012/07/10/requesting-hyper-v-replica-certificates-from-an-enterprise-ca.aspx

hope helps!

technet subscriber support

if technet subscription user , have feedback on our support quality, please send feedback here.

lawrence

technet community support



Windows Server  >  Hyper-V



Comments

Post a Comment

Popular posts from this blog

CRL Revocation always failed

-
hi all, i try configure radius server nps, somehow certificate authentication client failed with reason: reason = revocation function unable check revocation because revocation server offline. then check certificate client, certutil -f -urlfetch -verify client7.cer, result follow: issuer:     cn=entca     dc=intra     dc=domain     dc=co     dc=sg subject:     cn=computer.intra.domain.co.sg cert serial number: 1c5b00de000000000041 dwflags = ca_verify_flags_allow_untrusted_root (0x1) dwflags = ca_verify_flags_ignore_offline (0x2) dwflags = ca_verify_flags_full_chain_revocation (0x8) dwflags = ca_verify_flags_console_trace (0x20000000) dwflags = ca_verify_flags_dump_chain (0x40000000) chainflags = cert_chain_revocation_check_chain (0x20000000) hcce_local_machine cert_chain_policy_base -------- cert_chain_context -------- chaincontext.dwinfostatus = ce...
Read more

Failed to query the results of bpa xpath

-
Image
i have new server installed hyper v, iis , domain services roles on it.  i checking event log , see warning multiple times, idea how rid of it?? failed query results of bpa xpath: microsoft/windows/fileservices:$reports$\*\result.xml:/resultdatabase/result. error: device attached system not functioning., last error: system cannot find path specified.. follow me on twitter <<< levalencia blog <<< hi, similar issue discussed in forum: to rid of warnings: 1. go dashboard 2. click on add roles , features 3. click next "before begin step" 4. select "role based or feature based installation" , click next 5. select given server server pool , click next 6. in server roles step make sure following checked:   file , storage services > file , iscsi services > file server, click next 7.click next through rest of steps , install server role 8. rerun bpa scan described earlier for more information please refer foll...
Read more

0x300000d errors in Microsoft Remote Desktop client

-
we use rd connect home users office. @ server side remote desktop gateway configured on 2008r2 server. experience following:   for years worked fine, starting last year users apple macbook experienced connection errors after new version of microsoft remote desktop in app store , automatic update. after couple of weeks error disappaered when new updates released. since 6 8 weeks problem again. because don’t have macbook cannot reproduce problem.   starting couple of weeks samsung s6 experiencing problems, here version 8.1.37.135 installed, error displayed is: can’t connect tot remote pc because remote desktop gateway server temporaraily unavailable. try connecting later or contact network administrator assistance. error code  0x300000d   because has worked fine years expect issues on client can configuration error on gateway server.   who pin point real cause?   however, testing other rd gateway server works ok settings identically....
Read more