NSX Compute Manager 'Connection Status' Down
search cancel

NSX Compute Manager 'Connection Status' Down

book

Article ID: 317794

calendar_today

Updated On:

Products

VMware NSX VMware vCenter Server VMware NSX Data Center for vSphere VMware Cloud Foundation

Issue/Introduction

  • Compute Manager 'Connection Status' in NSX shows Down. 


  • If you attempt to edit the Compute Manager and click 'Save', you are unable to register the Compute Manager and may encounter an error similar to one of the following:
    Computer manager <name> with Id <ID> connection config is invalid. Edit Hostname and provide computer manager credentials. (Error code: 7055)
Certificate Chain of Computer Manager <name> is invalid. Please check Issuer and subject in the chain. (Error code: 90204)
  • In NSX 9.0+, an error message may show Error code: 7058 along with:
    Unable to connect to the compute manager <vCenter_name> as its trusted root certificate cannot be found. Validate the certificate chain in vCenter and then re-register the compute manager by editing it.
  • The last inventory update date could match these scenarios:
    • Environment may have been upgraded recently (NSX-T Data Center and/or vCenter).
    • vCenter Certificates may have been updated/changed recently.
  • You may see messages similar to the following in the  /var/log/cm-inventory/cm-inventory.log file on the NSX manager node:
    <timestamps>  INFO http-nio-127.0.0.1-7443-exec-2 NsxTrustManagerBinding - SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="cm-inventory"] Try create  TrustManager of type PKIX
<timestamps>  WARN http-nio-127.0.0.1-7443-exec-2 VcUtilsImpl - SYSTEM [nsx@6876 comp="nsx-manager" level="WARNING" subcomp="cm-inventory"] IOException occurred
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: java.security.cert.CertPathBuilderException: Unable to find certificate chain.

  • If the vCenter Server certificate was recently replaced with a custom CA-signed certificate, you may see messages similar to the following in the  /var/log/cm-inventory/cm-inventory.log file on the NSX manager node:

    <timestamps> ERROR http-nio-127.0.0.1-7443-exec-2 VcPlugin 4732 SYSTEM [nsx@6876 comp="nsx-manager" errorCode="MP40219" level="ERROR" reqId=<request id> subcomp="cm-inventory" username="admin"] Certificate of Vc example.com is invalid. It might be caused by issuer not being same as subject of next certificate in certificate chain.
  • If you attempt to add a new compute manager to an existing NSX cluster, you may see messages similar to the following in the /var/log/cm-inventory/cm-inventory.log file on the NSX manager node:

    <timestamps> ERROR http-nio-127.0.0.1-7443-exec-3 VcPlugin - SYSTEM [nsx@6876 comp="nsx-manager" errorCode="MP40106" level="ERROR" subcomp="cm-inventory"] Unable to login with username password for <IP/FQDN>
com.vmware.vim.vmomi.client.exception.SslException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: java.security.cert.CertPathBuilderException: No issuer certificate for certificate in certification path found.

Environment

  • VMware NSX
  • VMware vCenter Server
  • VMware Cloud Foundation 9

Cause

 NSX Manager cannot connect with the respective Compute Manager. This can happen for the following reasons:

  • The Compute Manager server certificate was replaced, and its new thumbprint does not match the one stored in NSX.
  • The Compute Manager server certificate is invalid (for example, expired or has an invalid certificate chain).
  • The Compute Manager server is unreachable from NSX Manager over the required TCP ports.
  • The Compute Manager is no longer registered with NSX Manager, and its Registration Status displays Not Registered. 

Resolution

  1. Log in to NSX Manager.

  2. Navigate to System → Fabric → Compute Managers

  3. Under the Connection Status column, click Down to check the error message present on the Compute Manager.

  4. Perform the action specified in the error message to resolve the issue, or refer to the corresponding Knowledge Base article below based on the error message: 

    1. Compute Manager can not be connected, as its thumbprint does not match — Refer to Compute Manager can not be connected, as its thumbprint does not match.

    2. Certificate chain of Compute Manager is invalid — Refer to NSX error "Certificate chain of compute manager "VC-FQDN"/"VC-shortname" is invalid (Error code: 90204)".

    3. Compute Manager certificate is expired — Refer to NSX Compute Manager connection is DOWN with error "Compute Manager certificate is expired. Please renew it and edit Compute Manager to update its thumbprint in NSX."

    4. Unable to connect to the compute manager as its trusted root certificate cannot be found - Refer to NSX Compute Manager connection is DOWN with error "Compute Manager certificate is expired. Please renew it and edit Compute Manager to update its thumbprint in NSX."

    5. Field level validation errors: {value 0 of property reverse_proxy_https_port has violated the minimum valid value 1} — Refer to Error 255: reverse_proxy_https_port validation failure when editing Compute Manager in NSX

    6. Failed to remove NSX ownership — Refer to NSX compute manager is showing "Registered with Errors"

  5. After remediation, verify that Connection Status displays as Up and Registration Status displays as Registered. 

Additional Information

NSX Installation Guide
 
API Guide
 
 
Powered by Wolken Software