Replacing the SSL certificate for the relational data store fails when the certificate's subject alternative name (SAN) resolves to the datastore machine but the common name does not resolve to the datastore machine.

Workaround

Use a CA-signed, or domain certificate where the common name resolves to the data store machine (either when the data store machine name is explicitly defined as the common name or when a wildcard alias matching the data store machine's FQDN is defined as the common name), and the SAN resolves to the data store machine

Steps to Reproduce