When using CA signed certificates on NSX Unified appliance AND certificate not being a full chain, including Root, Intermediate and leaf certificate. Post installation, you experience these symptoms:
The application server is unable to fulfill your request due to insufficient privileges. You do not have the privileges to access NSX Intelligence. (403 Forbidden)
/var/log/pace/token-registration.log
file of the NSX Intelligence appliance, you see entries similar to:"ERROR: PACE Invalid cluster certificate used. Please use self-signed cert or upload FULL chain of CA signed cert including ROOT authority public cert!!'"
VMware NSX-T Data Center 2.5.x
This is a known issue in how chain certificate export is done at the Certificate Authority (CA). It affects all releases of NSX-T Data Center and NSX Intelligence.
Currently, there is no resolution.
Workaround:
To work around this issue:
Note: All workaround steps require that the unsuccessfully deployed NSX Intelligence appliance is deleted.