Compute Manager can not be connected, as its thumbprint does not match
search cancel

Compute Manager can not be connected, as its thumbprint does not match

book

Article ID: 323341

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • After a vCenter server certificate is replaced (manually or automatically), the connection between NSX and vCenter might break and cause the NSX Compute Manager Connection Status to be Down on the System > Fabric > Compute Managers NSX UI.
  • Clicking Down displays the following error message:
    Compute Manager <Compute Manager Host Name> can not be connected, as its thumbprint does not match. Please edit compute manager details if thumbprint is changed.
  • From 4.2.5 release:
    Compute Manager <Compute Manager Host Name> can not be connected, as its thumbprint does not match the vCenter certificate thumbprint.To resolve this issue, edit the Compute Manager, click 'Save', and accept the new thumbprint. For more information, refer to this KB.


 

Note: The Resolve button in the error message window is disabled and cannot be used to resolve this issue.

Environment

NSX 4.2.x 
vCenter 8.0.x

Cause

  • When the vCenter Server certificate is replaced, vCenter Server presents the new certificate on every connection NSX initiates.
  • NSX does not trust this certificate because it still has the previous certificate's thumbprint stored for that Compute Manager.
  • As a security measure, NSX blocks the connection until the new thumbprint is updated.

Resolution

  • Log in to NSX Manager.
  • Navigate to System > Fabric > Compute Managers.
  • Select the affected Compute Manager and click Edit.
  • Click SAVE without making any changes. NSX detects the new certificate thumbprint and prompts you to confirm it.

 

  • Click ADD to accept the new thumbprint and complete re-registration.

           

 

  • Verify that the Connection Status shows Up.

Additional Information

To verify the current vCenter Server certificate thumbprint explicitly, run the following command from the vCenter Server Appliance Shell:

echo | openssl s_client -connect localhost:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256


Example output:

sha256 Fingerprint=##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##

 

Refer below KBs for more information:

Powered by Wolken Software