Compute Manager can not be connected, as its thumbprint does not match
Article ID: 323341
Updated On:
Products
Issue/Introduction
- After a vCenter server certificate is replaced (manually or automatically), the connection between NSX and vCenter might break and cause the NSX Compute Manager Connection Status to be Down on the System > Fabric > Compute Managers NSX UI.
- Clicking Down displays the following error message:
Compute Manager <Compute Manager Host Name> can not be connected, as its thumbprint does not match. Please edit compute manager details if thumbprint is changed. - From 4.2.5 release:
Compute Manager <Compute Manager Host Name> can not be connected, as its thumbprint does not match the vCenter certificate thumbprint.To resolve this issue, edit the Compute Manager, click 'Save', and accept the new thumbprint. For more information, refer to this KB.
Note: The Resolve button in the error message window is disabled and cannot be used to resolve this issue.
Environment
VMware NSX
VMware vCenter
Virtual Cloud Foundation (VCF) 9
Cause
- When the vCenter Server certificate is replaced, vCenter Server presents the new certificate on every connection NSX initiates.
- NSX does not trust this certificate because it still has the previous certificate's thumbprint stored for that Compute Manager.
- As a security measure, NSX blocks the connection until the new thumbprint is updated.
Resolution
- Log in to NSX Manager.
- Navigate to System > Fabric > Compute Managers.
- Select the affected Compute Manager and click Edit.
- Click SAVE without making any changes. NSX detects the new certificate thumbprint and prompts you to confirm it.
- Click ADD to accept the new thumbprint and complete re-registration.
- Verify that the Connection Status shows Up.
In Virtual Cloud Foundation (VCF) environments where certificates are managed by VCF Operations, the certificate thumbprint field will not appear. VCF manages certificates and synchronizes trust between components.
However, in some cases the certificate trust does not update correctly.
To refresh the Compute Manager thumbprint and service account in a VCF 9.x environment:
- Change the FQDN by changing the capitalization of one of the letters in the domain name, then provide vCenter credentials in the username and password fields that will appear.
- If desired, the FQDN capitalization can be changed back using the same process.
- Adding or editing a comment will not trigger a thumbprint refresh.
Additional Information
To verify the current vCenter Server certificate thumbprint explicitly, run the following command from the vCenter Server Appliance Shell:
echo | openssl s_client -connect localhost:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256
Example output:
sha256 Fingerprint=##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##
Refer to these knowledge base articles for other errors that may appear while connecting to a Compute Manager:
- Certificate chain of Compute Manager is invalid
NSX error "Certificate chain of compute manager "VC-FQDN"/"VC-shortname" is invalid (Error code: 90204)" - Compute Manager certificate is expired
NSX Compute Manager connection is DOWN with error "Compute Manager certificate is expired. Please renew it and edit Compute Manager to update its thumbprint in NSX." - Field level validation errors: {value 0 of property reverse_proxy_https_port has violated the minimum valid value 1}
Error 255: reverse_proxy_https_port validation failure when editing Compute Manager in NSX - Failed to remove NSX ownership
NSX compute manager is showing "Registered with Errors"
Feedback
