Handling expired NSX Intelligence node certificate
search cancel

Handling expired NSX Intelligence node certificate

book

Article ID: 325117

calendar_today

Updated On:

Products

VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

This article provide steps on handling expired NSX Intelligence node certificate.

Environment

VMware NSX-T Data Center 3.x

Resolution

  1. Use CLI to update the certificate on the NSX Intelligence node:

    For example:

    set intelligence node cert-b64-encoded-pem LSAM...UdJT cert-b64-private-key ES8tL...CRJM


  2. Log in to the NSX Manager User Interface (Unified Appliance UI) and import the self-signed certificate used in step-1 and note down the certificate ID for this newly created/imported certificate.
     
  3. Get the pace node principal identity ID:

    For example:

    curl -i -k  --request GET 'https://<NSXMGR_IP>/api/v1/trust-management/principal-identities' --header 'Content-Type: application/json' --header 'X-NSX-Username: admin' --header 'Authorization: Basic YWRtaW46QWRtaW4hMjNBZG1pbg=='

    Note: Ensure to note down the ID in the output with "name": "nsx-intelligence" and "node_id": "pace_node".

  4. Update the principal identity of NSX Intelligence node using this curl command:

    For example:

    curl -i -k  --request POST 'https://<NSXMGR_IP>/api/v1/trust-management/principal-identities?action=update_certificate' --header 'X-NSX-Username: admin' --header 'x-allow-overwrite: true' --header 'Authorization: Basic ############taW4hMjNBZG1pbg==' --header 'Content-Type: application/json' --data-raw '{
        "principal_identity_id" : <principal_identity_id_from_step_3>,
        "certificate_id" : <certificate_id_from_step_2>
    }'

  5. Log in to all three NSX Manager nodes (Unified appliances) using SSH and admin user. 
  6. Restart the http service on all three nodes by running this command:

    restart service http
     
  7. Wait for the Unified Appliance cluster to become stable by verifying using this command:

    get cluster status
     
  8. Log in to NSX Intelligence node using SSH and root user and run this command:

    /opt/vmware/pace/server/pace-server-post-cert-node-register.sh
     
  9. Wait for the NSX Intelligence node to come to stable state by tracking its state from NSX Manager UI(Unified Appliance UI).