{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/", "slug": "dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup", "url": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/" }, "title": "Use exact certificate names for Service Fabric presentation lookup", "summary": "Why can a name accepted by Service Fabric certificate validation fail to locate the node's own certificate?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:06+00:00", "modified_at": "2026-09-10T02:11:18+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 235, "potentially_affected": "Service Fabric clusters declaring presented certificates by subject common name.", "dse_recommendation": "DSE recommends comparing the presentation declaration with the installed certificate's actual subject common name character for character.", "primary_source": { "name": "X.509 Certificate-based Authentication in a Service Fabric Cluster - Azure Service Fabric | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/service-fabric/cluster-security-certificates", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Service Fabric’s common-name presentation lookup requires an exact, case-sensitive match to the configured name. Its certificate validation rules instead support case-insensitive matching and wildcards. For validation, either the subject common name or a subject alternative name can match the declared name. These are different lookup and acceptance rules. Microsoft Learn.

\n

Applicability

\n

Use this review when a node cannot load its certificate even though a similar name would pass a remote validation check. Separate the node’s local certificate-selection declaration from the rules another node uses to accept a credential. Do not assume a wildcard or a subject alternative name is a substitute for the local presentation match.

\n

DSE recommendation

\n

DSE recommends comparing the presentation declaration with the installed certificate’s actual subject common name character for character. Have the owner also confirm the configured certificate store and the intended credential. Do not relax trust validation to compensate for a local name mismatch; identify which stage failed before proposing a correction.

\n

Verification

\n

In an approved diagnostic session, capture the relevant declaration, certificate identity and loading error without exporting private keys. Check the exact name match locally, then examine the separate validation configuration for the remote connection. After any authorized correction, confirm which certificate the node actually presents and whether its peers accept it. Retain both results rather than treating certificate presence in a store as a completed authentication test.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nService Fabric’s common-name presentation lookup requires an exact, case-sensitive match to the configured name. Its certificate validation rules instead support case-insensitive matching and wildcards. For validation, either the subject common name or a subject alternative name can match the declared name. These are different lookup and acceptance rules. Microsoft Learn.\nApplicability\nUse this review when a node cannot load its certificate even though a similar name would pass a remote validation check. Separate the node’s local certificate-selection declaration from the rules another node uses to accept a credential. Do not assume a wildcard or a subject alternative name is a substitute for the local presentation match.\nDSE recommendation\nDSE recommends comparing the presentation declaration with the installed certificate’s actual subject common name character for character. Have the owner also confirm the configured certificate store and the intended credential. Do not relax trust validation to compensate for a local name mismatch; identify which stage failed before proposing a correction.\nVerification\nIn an approved diagnostic session, capture the relevant declaration, certificate identity and loading error without exporting private keys. Check the exact name match locally, then examine the separate validation configuration for the remote connection. After any authorized correction, confirm which certificate the node actually presents and whether its peers accept it. Retain both results rather than treating certificate presence in a store as a completed authentication test.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nService Fabric’s common-name presentation lookup requires an exact, case-sensitive match to the configured name. Its certificate validation rules instead support case-insensitive matching and wildcards. For validation, either the subject common name or a subject alternative name can match the declared name. These are different lookup and acceptance rules. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/cluster-security-certificates).\n\n## Applicability\n\nUse this review when a node cannot load its certificate even though a similar name would pass a remote validation check. Separate the node’s local certificate-selection declaration from the rules another node uses to accept a credential. Do not assume a wildcard or a subject alternative name is a substitute for the local presentation match.\n\n## DSE recommendation\n\nDSE recommends comparing the presentation declaration with the installed certificate’s actual subject common name character for character. Have the owner also confirm the configured certificate store and the intended credential. Do not relax trust validation to compensate for a local name mismatch; identify which stage failed before proposing a correction.\n\n## Verification\n\nIn an approved diagnostic session, capture the relevant declaration, certificate identity and loading error without exporting private keys. Check the exact name match locally, then examine the separate validation configuration for the remote connection. After any authorized correction, confirm which certificate the node actually presents and whether its peers accept it. Retain both results rather than treating certificate presence in a store as a completed authentication test.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/cluster-security-certificates). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/", "url": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use exact certificate names for Service Fabric presentation lookup", "item": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/", "url": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/", "headline": "Use exact certificate names for Service Fabric presentation lookup", "description": "Why can a name accepted by Service Fabric certificate validation fail to locate the node's own certificate?", "abstract": "Why can a name accepted by Service Fabric certificate validation fail to locate the node's own certificate?", "articleBody": "Source facts\nService Fabric’s common-name presentation lookup requires an exact, case-sensitive match to the configured name. Its certificate validation rules instead support case-insensitive matching and wildcards. For validation, either the subject common name or a subject alternative name can match the declared name. These are different lookup and acceptance rules. Microsoft Learn.\nApplicability\nUse this review when a node cannot load its certificate even though a similar name would pass a remote validation check. Separate the node’s local certificate-selection declaration from the rules another node uses to accept a credential. Do not assume a wildcard or a subject alternative name is a substitute for the local presentation match.\nDSE recommendation\nDSE recommends comparing the presentation declaration with the installed certificate’s actual subject common name character for character. Have the owner also confirm the configured certificate store and the intended credential. Do not relax trust validation to compensate for a local name mismatch; identify which stage failed before proposing a correction.\nVerification\nIn an approved diagnostic session, capture the relevant declaration, certificate identity and loading error without exporting private keys. Check the exact name match locally, then examine the separate validation configuration for the remote connection. After any authorized correction, confirm which certificate the node actually presents and whether its peers accept it. Retain both results rather than treating certificate presence in a store as a completed authentication test.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:23:06+00:00", "dateModified": "2026-09-10T02:11:18+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use exact certificate names for Service Fabric presentation lookup" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 235, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "X.509 Certificate-based Authentication in a Service Fabric Cluster - Azure Service Fabric | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/service-fabric/cluster-security-certificates" } } ] } }