# Use exact certificate names for Service Fabric presentation lookup

> Why can a name accepted by Service Fabric certificate validation fail to locate the node's own certificate?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:23:06+00:00
- Modified: 2026-09-10T02:11:18+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Why can a name accepted by Service Fabric certificate validation fail to locate the node's own certificate?

## Potentially affected

Service Fabric clusters declaring presented certificates by subject common name.

## DSE recommendation

DSE recommends comparing the presentation declaration with the installed certificate's actual subject common name character for character.

## Article

## Source facts

Service Fabric’s common-name presentation lookup requires an exact, case-sensitive match to the configured name. Its certificate validation rules instead support case-insensitive matching and wildcards. For validation, either the subject common name or a subject alternative name can match the declared name. These are different lookup and acceptance rules. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/cluster-security-certificates).

## Applicability

Use this review when a node cannot load its certificate even though a similar name would pass a remote validation check. Separate the node’s local certificate-selection declaration from the rules another node uses to accept a credential. Do not assume a wildcard or a subject alternative name is a substitute for the local presentation match.

## DSE recommendation

DSE recommends comparing the presentation declaration with the installed certificate’s actual subject common name character for character. Have the owner also confirm the configured certificate store and the intended credential. Do not relax trust validation to compensate for a local name mismatch; identify which stage failed before proposing a correction.

## Verification

In an approved diagnostic session, capture the relevant declaration, certificate identity and loading error without exporting private keys. Check the exact name match locally, then examine the separate validation configuration for the remote connection. After any authorized correction, confirm which certificate the node actually presents and whether its peers accept it. Retain both results rather than treating certificate presence in a store as a completed authentication test.

## Official references

[Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/cluster-security-certificates). Source retrieved September 9, 2026.

## Primary reference

- Name: X.509 Certificate-based Authentication in a Service Fabric Cluster - Azure Service Fabric | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/service-fabric/cluster-security-certificates
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use exact certificate names for Service Fabric presentation lookup,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-530-use-exact-certificate-names-for-service-fabric-presentation-lookup/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.