Scripted process to replace expired or self-signed VMware NSX Manager Certificates with VMCA-Signed Certificates

Products

VMware Cloud Foundation VMware NSX

Issue/Introduction

The process of generating a Certificate Signing Request (CSR), creating a certificate, then importing and deploying the certificate via the VMware Certificate Authority (VMCA) involves manual work, with making REST API calls. This KB article helps to automate the entire process with a script.

There are expired certificates or self-signed certificates on the NSX Managers and NSX VIP:

Due to expired certificates - these cannot be replaced by a management interface like the SDDC Manager. They have to replaced directly on the NSX Managers.
Due to self-signed certificates - SDDC Manager does not trust the certificate, and therefore needs to be replaced with a VMCA signed certificate.

Environment

VMware NSX-T Data Center
VMware NSX

Cause

Expired or Self-Signed certificates on the NSX Manager nodes trigger alarms and may impact workflow, such as those with the VCF SDDC Manager.

Resolution

NOTES:
- The script must be run on the vCenter Server (Compute Manager) registered with the VMware NSX Managers. Confirm under: System > Fabric > Compute Managers.
- The script will only replace the Manager Node Certificate and Cluster (VIP) certificate; it is not intended for use with any other certificates.
- The script is available to download from this KB article.
Script Usage:

To see the syntax and commands available, run: python nsxVmcaCert.py
1. Download the script: nsxtVmcaCert.py
2. Copy the script to the vCenter Server (Compute Manager) connected to your VMware NSX environment using WinSCP
  NOTE: If you encounter trouble copying the script to vCenter, the instructions in Connecting to vCenter Server Virtual Appliance using WinSCP fails with the error: will help enable SCP for root on vCenter Server (Compute Manager), allowing you to copy the script to the vCenter Server (Compute Manager).
3. Run the script with the FQDN of each NSX manager node or the VIP, with the appropriate flags, and supply the password for the admin user.
  NOTES:
  - The FQDN for the NSX manager can be verified with the below API call, and the same FQDN value must be passed to run the Python script for replacing the certificates: GET https://<NSX-Manager-IP>/api/v1/cluster
  - The script must be executed for each VMware NSX Manager and the corresponding VIP FQDN that requires the certificate replacement.
    For example: If there are three VMware NSX Manager nodes and a VIP configured, the script needs to be run four times:
    python nsxtVmcaCert.py -f <nsx-manager-node1-fqdn> -m
    
    python nsxtVmcaCert.py -f <nsx-manager-node2-fqdn> -m
    
    python nsxtVmcaCert.py -f <nsx-manager-node3-fqdn> -m
    
    python nsxtVmcaCert.py -f <cluster-vip-fqdn-address> -v
    1. Command for NSX Manager, node certificate replacement. Repeat for each manager node in the cluster: # python nsxtVmcaCert.py -f <nsx_manager_fqdn> -m
    2. You will be prompted for the VMware NSX manager admin user's password. Enter it to proceed.
    3. Command for the Cluster VIP FQDN; only need to run against one manager: # python nsxtVmcaCert.py -f <nsxt_vip_fqdn> -v
    4. You will be prompted for the VMware NSX manager admin user's password. Enter it to proceed.

Additional Information

Note: Update any Broadcom-integrated products, such as Aria Operations and Aria Operations for Logs (formerly known as vROps and vRLI), as well as any third-party products that integrate with NSX Managers, to ensure they accept the new certificates.

File checksum info:

The hashes listed are only valid for the current version of nsxtVmcaCert.py.
Date hash updated: July 18,2025

MD5SUM: d3eb72e39b186c2029060bdc40497ef0
SHA256SUM: b3316bc3c3f988dafd8ddb1a746f986d10edc7b3c4ec13e1fdb90c4485a976df

If the NSX Manager is configured with a short hostname, or if the input to the script was not a case sensitive match to the manager's hostname, the script will fail with:

Failed to get the UUID associated with the name ######. Ensure the manager's hostname is set to the fully qualified domain name and the input to this command matches (including case).

The affected NSX Manager's hostname can be updated to a FQDN by executing the following from the CLI: set hostname <FQDN>

Attachments

nsxtVmcaCert.py get_app