When a vCenter pre-check says its Primary Network Identifier (PNID) does not match its hostname, compare the two exact values before changing certificates or directory settings. Broadcom documents mismatches that differ only in letter case. A name resolving successfully in DNS does not establish that vCenter's stored identity and operating-system hostname agree. A18-S1, A18-S2
The scope is vCenter Server Appliance 7.x and 8.x. These are source-checked, unexecuted read-only examples. No diagnostic tool, appliance command or identity change was run for this article.
Understand the three values
The operating-system hostname is one observation. The PNID is the identity returned by VMware's authentication framework utility. The Machine SSL certificate supplies a third identity reference that Broadcom's diagnostic asks administrators to compare.
These are related records, not interchangeable evidence. A browser reaching a familiar URL shows neither that the appliance hostname matches the PNID nor that the certificate's name and validity are suitable. Likewise, an unexpired certificate can coexist with inconsistent appliance identity.
This distinction prevents an expensive detour. Replacing every certificate because an upgrade pre-check reports a name mismatch can alter trust relationships while leaving the actual mismatch unexplained.
Capture the comparison without changing it
Prerequisites are an already authorised appliance shell or existing diagnostic output, the exact vCenter build, topology information and the relevant warning text. Do not enable SSH or install VDT simply to follow this article. If the required access is absent, ask the responsible administrator for the two read-only outputs.
Broadcom documents these commands:
hostname
/usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost
The first reads the appliance hostname; the second reads its PNID. Neither command sets a value. Run them only on the identified appliance under the site's approved access procedure; they were not executed here. A18-S1
Preserve the exact spelling and timestamp in a restricted incident record. Do not automatically lowercase, shorten or append a domain suffix to make the values look consistent. Such normalisation would erase the difference this investigation is trying to explain.
Obtain the existing Machine SSL certificate identity from the approved certificate inventory or management view. Compare its relevant name with the PNID and hostname as Broadcom requests. No private key is needed, and there is no reason to include one in the report.
A worked case comparison
Consider this invented evidence:
| Record | Value |
|---|---|
| Hostname | vcenter01.example.test |
| PNID | vCenter01.example.test |
| Pre-check | Hostname does not match PNID |
This is a case-only mismatch. Broadcom KB 368672 explicitly describes this class of configuration problem and requires exact case matching. Treating both strings as equal because DNS names are normally case-insensitive misses the product-specific check. A18-S2
If instead the two command outputs match exactly but the warning came from yesterday's evidence, first establish whether the current comparison and the warning refer to the same appliance and time. Do not alter a consistent current identity merely to satisfy a stale screenshot.
If the Machine SSL identity also disagrees, record a three-way inconsistency. That deserves a supported identity investigation; it is not enough to choose whichever value appears most familiar and change the others to it.
Separate nearby authentication problems
A certificate past its validity date is a different finding and belongs to the certificate-expiry diagnostic. An AD-only sign-in failure can involve the external identity source and should not be attributed to PNID drift without matching evidence.
Broadcom also lists an IWA sign-in symptom in its hostname-mismatch article. That is a documented possibility, not proof that every “invalid credentials” error originates from the appliance hostname. Keep the observed mismatch and authentication symptom as separate facts until the evidence connects them.
For the documented mismatch, Broadcom’s resolution changes the hostname to match the PNID exactly, including case, through VAMI. It does not invite choosing either identity as the authority. The procedure remains outside this inspection. KB 368672 requires appropriate snapshots of the vCenter nodes (including linked nodes in ELM), a VAMI backup and changing only one network setting at a time. These are prerequisites for a separately reviewed recovery plan, not backup/snapshot jobs to launch during diagnosis; linked-node consistency and solution registrations still need qualified assessment.
Acceptance and reversal limits
The diagnostic is complete when it records exact hostname and PNID values, the relevant Machine SSL identity, build and topology, and whether the warning is current. An unresolved third-party integration dependency should remain explicit.
Broadcom's correction procedure changes appliance networking configuration and restarts services. It warns that registered solutions may require additional handling. This article does not reproduce that change sequence or recommend certificate resets. A qualified plan must cover linked-node consistency, integrations, supported backups and an appropriate recovery procedure before modifying identity. A18-S2
For a later approved correction, proposed acceptance includes exact identity agreement, the relevant pre-check result and working dependent integrations. A successful local login alone is insufficient. These checks have not been performed here.
Reading the two values needs no rollback. Changing them does: do not assume renaming back restores every trust relationship automatically.
Learning notes
- DNS equivalence is not the same as exact product identity consistency.
- Hostname, PNID and certificate identity are separate observations.
- A mismatch is a reason to plan a precise correction, not reset all trust.
References
- A18-S1: Executing VDT on vCenter displays error:"The PNID (Expected_vCenter_hostname) does not match the hostname (Actual vCenter_hostname)"
- A18-S2: How to update vCenter hostname to match PNID