Use exact certificate names for Service Fabric presentation lookup

Source facts

Service Fabric’s common-name presentation lookup requires an exact, case-sensitive match to the configured name. Its certificate validation rules instead support case-insensitive matching and wildcards. For validation, either the subject common name or a subject alternative name can match the declared name. These are different lookup and acceptance rules. Microsoft Learn.

Applicability

Use this review when a node cannot load its certificate even though a similar name would pass a remote validation check. Separate the node’s local certificate-selection declaration from the rules another node uses to accept a credential. Do not assume a wildcard or a subject alternative name is a substitute for the local presentation match.

DSE recommendation

DSE recommends comparing the presentation declaration with the installed certificate’s actual subject common name character for character. Have the owner also confirm the configured certificate store and the intended credential. Do not relax trust validation to compensate for a local name mismatch; identify which stage failed before proposing a correction.

Verification

In an approved diagnostic session, capture the relevant declaration, certificate identity and loading error without exporting private keys. Check the exact name match locally, then examine the separate validation configuration for the remote connection. After any authorized correction, confirm which certificate the node actually presents and whether its peers accept it. Retain both results rather than treating certificate presence in a store as a completed authentication test.

Official references

Microsoft Learn. Source retrieved September 9, 2026.