Registration of NSX Manager UI with Lookup Service fails with the error: NSX management service operation failed. (404 Not found)

Products

• VMware NSX

Issue/Introduction

Symptoms:

• Registration of NSX Manager User Interface with Lookup Service fails.

• You see the error:

  NSX management service operation failed. (404 Not found)

• In the NSX Manager logs, you see entries similar to:

  2017-06-30 09:39:31.688 UTC INFO http-nio-127.0.0.1-7441-exec-503 PreAuthenticatedAuthenticationProvider:55 - User is authenticated by reverse proxy : NSX Appliance Manager
  2017-06-30 09:39:31.691 UTC INFO http-nio-127.0.0.1-7441-exec-503 AuditingServiceImpl:147 - [AuditLog] UserName:'System', ModuleName:'ACCESS_CONTROL', Operation:'LOGIN', Resource:'NSX Appliance Manager', Time:'Fri Jun 30 09:39:31.690 UTC 2017', Status:'SUCCESS', Universal Object:'false'
  2017-06-30 09:39:31.693 UTC INFO http-nio-127.0.0.1-7441-exec-503 UserSessionManager:43 - New session: ############################3D2F
  2017-06-30 09:39:31.719 UTC ERROR http-nio-127.0.0.1-7441-exec-503 BaseRestController:406 - Exception : 'The requested object : certificate-125 could not be found. Object identifiers are case sensitive.' ===========>
  2017-06-30 09:39:33.473 UTC INFO messagingTaskExecutor-1 QueueSubscriptionManager:252 - Purging queue 'vse_########-####-####-####-############_request_queue'. No wait = 'true'.

  2017-06-30 09:39:36.844 UTC INFO http-nio-127.0.0.1-7441-exec-501 PreAuthenticatedAuthenticationProvider:55 - User is authenticated by reverse proxy : NSX Appliance Manager
  2017-06-30 09:39:36.847 UTC INFO http-nio-127.0.0.1-7441-exec-501 AuditingServiceImpl:147 - [AuditLog] UserName:'System', ModuleName:'ACCESS_CONTROL', Operation:'LOGIN', Resource:'NSX Appliance Manager', Time:'Fri Jun 30 09:39:36.846 UTC 2017', Status:'SUCCESS', Universal Object:'false'
  2017-06-30 09:39:36.853 UTC INFO http-nio-127.0.0.1-7441-exec-501 UserSessionManager:43 - New session: #############################9160
  2017-06-30 09:39:36.877 UTC ERROR http-nio-127.0.0.1-7441-exec-501 BaseRestController:406 - Exception : 'The requested object : certificate-125 could not be found. Object identifiers are case sensitive.'
  2017-06-30 09:39:38.765 UTC INFO User LoginLogout Deflate Thread UserLoginLogoutEventRaiser:250 - Raise 2 user login/logout events
  2017-06-30 09:39:38.768 UTC INFO User LoginLogout Deflate Thread UserLoginLogoutEventRaiser:254 - Raise 10 group login/logout events

  Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

NSX for vSphere

Resolution

To resolve this issue:

1. Verify that the certificate has the correct values using the web browser where Subject Alternative Name must be the FQDN of the vCenter Server Appliance.
2. To verify Select the Browser SSL "Lock" icon to View the Certificate details.
3. If Subject Alternative is IP address or Hostname then log into Appliance and change the host name to FQDN by running this command:- hostname FQDN of vCenter.
4. Update the IP address, host name and FQDN of VCSA in "/etc/hosts" file by adding a line in hosts file in this manner: IP address hostname FQDN.
5. Save the hosts file and regenerate new VCSA certificates by either selecting regenerate certificate after reboot option from VAMI page of VCSA or by manually regenerating them using certificate manager.
6. Once the certificates are regenerated make sure that the Subject Alternative name in the certificate has FQDN in it instead of host name or IP address.
7. Now try to Register NSX Manager User Interface with Lookup Service and check if you are getting any error.
8. If the registration fails then you will see below error reported in NSX manager which indicates that certificate is not found in the database:
   2017-06-30 09:39:31.719 UTC ERROR http-nio-127.0.0.1-7441-exec-503 BaseRestController:406 - Exception : 'The requested object : certificate-125 could not be found. Object identifiers are case sensitive.'
9. Note down certificate id, in the above error the certificate ID is certificate-125.

10. Execute below query to insert dummy record for missing certificate (replace certificate-125 with certificate number that you receive in NSX Manager logs)

    #insert into domain_object(dtype, objectid, cascade_event_to_parent, cascade_parent_delete, objecttype, relationship_revision, revision ) values('Certificate', 'certificate-125','f', 't', 'Certificate', 0, 0);

11. Now register NSX Manager User Interface with Lookup Service.