Workaround for alarms not getting raised/resolved on License Hub (LH) after ingress certificate rotation

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention
• VMware Avi Load Balancer

Issue/Introduction

In the License Hub (LH), users may encounter one or all of the following issues:

1. If licensing-related alarms were triggered prior to ingress certificate rotation, they will not be resolved even after connectivity between the License Hub and Avi cloud console is restored.
2. If connectivity between the License Hub and Avi Cloud console is lost following ingress certificate rotation, new licensing-related alarms will fail to trigger.
3. Post ingress certificate rotation, if License Hub fails to process the license bundle received from Avi cloud console, then no alarm will be raised on License Hub.

These issues prevent users from knowing if there is a connectivity issue between License Hub and Avi Cloud Console.

Below are the alarms that are impacted:

1. License polling failure
2. Usage reporting failure
3. License file processing failure

Environment

vDefend License Hub 2.0

Cause

Perform Ingress Cert Rotation on LH.

Resolution

Steps:

1. Copy the attached script(fix_licensing_service_truststore.sh) to the License Hub VM.

2. Make it executable and run it as sysadmin (no root/sudo needed — it only needs kubectl access to the workload cluster):

chmod +x fix_licensing_service_truststore.sh
./fix_licensing_service_truststore.sh --help        # Print the options (Optional)
./fix_licensing_service_truststore.sh --dry-run     # Does a dry run of the script (Optional)
./fix_licensing_service_truststore.sh               # Execute the script

3. Verify: the script prints Done. "NAPP_PLATFORM_INGRESS is now trusted and licensing-service has restarted." on success. You can additionally confirm no more TLS errors with:

kubectl logs -n nsxi-platform deploy/licensing-service | grep -i "unknown authority"

4. Re-running is safe - it's idempotent; if the tag is already present it does nothing.

Additional Information

If you encounter alarms on SSP instead, you may refer to the KB: Workaround for alarms not getting raised/resolved on Security Services Platform (SSP) after ingress certificate rotation