NSX- T certificates have the following requirements:
- Server certificate (nsxt_fqdn.crt) must contain the Basic Constraints field with value CA:FALSE.
- Root CA certificate chain file (rootca.crt), intermediate certificates, and root certificate must contain the Basic Constraints field with value CA:TRUE
To verify if the certificate is complaint with the requirements, review the NSX-T server certificate using openssl
- On any system with openssl installed, use the command:
openssl x509 -in <path_to_NSXT_certificate_file> -noout -text
- On the SDDC Manager, use the below command:
openssl x509 -in /opt/vmware/vcf/operationsmanager/certificates/<domain_name>/<nsxt_fqdn>/<nsxt_fqdn>.crt -noout -textNote: Domain_name is the workload domain for which certificate replacement failed
- Under X509v3 Basic Constraints, check the CA bit value.
- For valid NSX-T Server certificate, the CA bit value should be CA:FALSE
For example:
X509v3 Basic Constraints: critical
CA:FALSE
- Re-generate the NSX-T server certificates if Basic Constraints field is set to CA:TRUE