When you rotate certificates for a VMware Cloud Foundation instance that is part of a Federation, the Certificate Signing Request (CSR) must match the CSR of the original certificate.
For more information on certificate rotation, see Certificate Management.