SSL certificate validation failure due to missing PTR record on ESXi host

Goal: Ensure that an ESXi host can be successfully enrolled to a vCenter Server without SSL certificate validation errors related to DNS resolution.

Constraint: The validation performed by the vSphere Certificate Authority (VMCA) requires that the forward and reverse DNS lookups for the host's FQDN are consistent and that the PTR record matches the FQDN contained in the host's SSL certificate.

Uncertainty: It is unclear whether a missing PTR record alone causes the VMCA to abort the certificate exchange, or if a mismatch between the PTR result and the certificate's FQDN is required to trigger the failure, and whether correcting the DNS record suffices or if the host certificate must be regenerated.

What specific check in the VMCA validation process fails when the PTR record is absent or returns a different name? Does fixing the PTR record restore trust, or is a new certificate needed? If the ESXi host's FQDN is changed after initial enrollment, must the host be removed and re‑added, or can the existing certificate be updated in place?