Replacing NSX-T certificate with CA signed certificates through SDDC Manager fails with "Data type mismatch, expected certificate_signed but received certificate_ca"..."

Products

• VMware Cloud Foundation

Issue/Introduction

Symptoms:

• In SDDC Manager, certificate replacement fails with below error:

Failed to replace certificate for nsxt_fqdn due to: 400 : "{<EOL> "httpStatus" : "BAD_REQUEST",<EOL> "error_code" : 2007,<EOL> "module_name" : "internal-framework",<EOL> "error_message" : "Data type mismatch, expected certificate_signed but received certificate_ca."<EOL>}"

• In /var/log/vmware/vcf/operationsmanager/operationsmanager.log, you see entries similar to:

2022-08-30T07:03:32.668+0000 ERROR [vcf_om,9b6ea2e9dbea41b7,4179] [c.v.v.c.n.NsxTManagerCertificatePlugin,om-exec-29] 400 : "{<EOL>  "httpStatus" : "BAD_REQUEST",<EOL>  "error_code" : 2007,<EOL>  "module_name" : "internal-framework",<EOL>  "error_message" : "Data type mismatch, expected certificate_signed but received certificate_ca."<EOL>}"

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware Cloud Foundation 4.x

Cause

This issue occurs if the NSX-T server Certificate is not compliant with the requirements.

Resolution

NSX- T certificates have the following requirements:

• Server certificate (nsxt_fqdn.crt) must contain the Basic Constraints field with value CA:FALSE.
• Root CA certificate chain file (rootca.crt), intermediate certificates, and root certificate must contain the Basic Constraints field with value CA:TRUE

To verify if the certificate is complaint with the requirements, review the NSX-T server certificate using openssl

• On any system with openssl installed, use the command:

openssl x509 -in <path_to_NSXT_certificate_file> -noout -text

• On the SDDC Manager, use the below command:

openssl x509 -in /opt/vmware/vcf/operationsmanager/certificates/<domain_name>/<nsxt_fqdn>/<nsxt_fqdn>.crt -noout -text

Note: Domain_name is the workload domain for which certificate replacement failed

• Under X509v3 Basic Constraints, check the CA bit value.
• For valid NSX-T Server certificate, the CA bit value should be CA:FALSE

For example:

            X509v3 Basic Constraints: critical
                CA:FALSE

• Re-generate the NSX-T server certificates if Basic Constraints field is set to CA:TRUE

Additional Information

For more information, see the "Install Third-Party CA-Signed Certificates" section of VMware Cloud Foundation Documentation