Updating the IP address, Certificate and Thumbprint of NSX Manager unified appliance

Products

• VMware NSX

Issue/Introduction

Symptoms:
After installing or upgrading to NSX Intelligence Appliance 1.1.0/1.2/1.2.1, you experience this symptom:

The NSX Intelligence appliance fails to complete certain actions.

Environment

VMware NSX-T Data Center 3.x
VMware NSX-T Data Center

Cause

This issue occurs when using NSX-T Intelligence 1.1.0/1.2/1.2.1. On these versions, the IP, thumbprint, and node certificate of the NSX Manager appliance that deploys NSX Intelligence gets saved on the NSX Intelligence appliance. If this NSX Manager appliance is deleted OR its IP address is changed OR its node certificate is changed, we need to update the info on NSX Intelligence by running certain CLI commands. Otherwise, the NSX Intelligence appliance will not be able to complete certain actions after installing or upgrading to version 1.1.0/1.2/1.2.1.

Resolution

To resolve this issue, update the IP address, certificate and thumbprint of the NSX Intelligence appliance.

For example, as part of deployment, NSX Intelligence appliance is deployed and registered with NSX Manager (IP: 10.10.0.10, thumbprint: old_t, node certificate: old_c)

Now if this NSX Manager appliance is deleted or its IP/node certificate changed, you need to update the NSX Intelligence appliance with the new or changed NSX Manager appliance information.

1. Collect NSX Manager appliance information.
   1. Pick an NSX Manager IP from the UI and login via SSH to the node as admin user.
   2. Get the node certificate by executing the following command on nsx-cli:
      
      For example:
      
      nsxmanager-1> get certificate api
      -----BEGIN CERTIFICATE-----
      ..cert snipped...
      -----END CERTIFICATE-----
       
   3. Get the thumbprint of the certificate using this command:
      
      For example:
      
      nsxmanager-12> get certificate api thumbprint
      thumbprint_of_the_cert_printed_here
       
2. Update the information on NSX Intelligence node.
   1. Log in to NSX Intelligence node via SSH as admin user.
   2. Update the IP and Certificate thumbprint using this command:
      
      For example:
      
      intelligence-cli> update intelligence manager node host-ip-addr 10.10.0.10 cert-thumbprint thumbprint_of_the_cert_printed_here
       
   3. Update the NSX Manager node certificate on NSX Intelligence using this command:
      
      For example:
      
      intelligence-cli> update intelligence manager node certificate <certificate-from-step1.2-in base64-format>
       
3. Optional steps required in certain scenarios:
   1. If the above steps were performed during or after upgrade from NSX Intelligence version 1.0.0, update the NSX UA cluster certificate stored on NSX Intelligence.
   2. Get cluster certificate from NSX UA. Call the API on NSX Manager: 
      
      https://{{nsx_ua_server}}/api/v1/trust-management/certificates?type=cluster_api_certificate
       
   3. Get the cluster certificate pem_encoded field in base64 format:
      
      echo -e "<value_of_pem_encoded_from_json_response>" | base64
      LS0tL...snipped...S0KCg==
       
   4. Update the certificate information on NSX Intelligence:
      
      For example:
      
      intelligence-cli> update intelligence manager cluster certificate <certificate-from-step3.1.2-in base64-format>
       
   5. Restart proxy on NSX Intelligence with this command:
      
      restart service http
       
   6. If the above steps were performed during or after upgrade, also restart the nsx-config service on NSX Intelligence appliance using this command:
      
      restart service nsx-config
       
   7. After waiting for a brief period of time post service restart - refresh your browser to ensure NSX Intelligence UI features are (re)loaded.