Failed to enable trust on Compute Manager in NSX

Products

• VMware NSX

Issue/Introduction

• NSX manager is deployed using vCenter plugin.
  
  
• After updating the vCenter certificate, the NSX Manager UI is no longer loading in vCenter.
  
  
• Updating the Compute Manager configuration fails, with the following error:
  "Failed to enable trust on Compute Manager due to error There already exists an OIDC end-point with issuer (Error code:90011)"
  
  
• When using VCF 9 and attaching a Computer Manager you get "No thumbprint is configured for the OIDC endpoint, and no trusted CA certificate for the OIDC endpoint has been imported."



Cause

The issue is due to a stale vCenter thumbprint entry in the NSX Manager DB.

Resolution

Workaround

Delete stale thumbprint entry and update new entry using API using the following steps:

1. Obtain the new SHA-256 thumbprint of the vCenter Server machine SSL certificate:
   root@vcsa-01 [ ~ ]# openssl s_client -connect <vcenter-ip/fqdn>:443 </dev/null 2>/dev/null | openssl x509 -fingerprint -sha256 -noout -in /dev/stdin
   
   
2. Use Postman or any REST API client and run the below GET API call:
   GET /api/v1/trust-management/oidc-uris
   
   The response should be 200 OK
   
   Retrieve the following values from the output:
   
   oidc_uri": "https://<vCenter FQDN>/openidconnect/vsphere.local/.well-known/openid-configuration",
"thumbprint": "ad45d34bfdbaecb42d2XXXXXXXXXXXXXXXXX",
"oidc_type": "vcenter",
"id": "ed1e58d0XXXXXXXXXXXX1111a837a26e",


3. Delete the old entry using the following API call:
   DELETE /api/v1/trust-management/oidc-uris/<enter-id-here>
   
   Example-
   https://<nsx-manager-ip>/api/v1/trust-management/oidc-uris/ed1e58d0XXXXXXXXXXXX1111a837a26e



4. Update oidc using the following API call:
   POST /api/v1/trust-management/oidc-uris/
   
   In the body enter the following:
   {
 "oidc_type": "As_per_output_of_GET_in_Step_2",
     "oidc_uri": "As_per_output_of_GET_in_Step_2",
     "thumbprint": "New_vcenter_thumbprint_as_per_output_in_Step_1"
    }
   
   The response should be  201 Created


Additional Information

When using VCF 9 a reboot of components may be required if the certificates match but you still get the error "No thumbprint is configured" 

Refer to KB 431963: Error 90011 "Failed to enable trust on Compute Manager" in NSX after vCenter Server certificate replacement with information about a similar issue that can occur in NSX 9.x/SDDC 9.x