NSX-T Upgrade in VCF environment fails with message "NSX-T manager has a common name that does not match its hostname."

Products

• VMware Cloud Foundation

Issue/Introduction

Symptoms:

• NSX-T upgrade failing with following error:

Message: “NSX-T FQDN”- NSX-T manager has a common name that does not match its hostname.

Remediation Message: NSX-T manager has a common name that does not match its hostname.Ensure that NSX-T manager has a valid certificate with its common name matching the host name.

• lcm-debug.log located at /var/log/vmware/vcf/lcm/ reports similar to below

YYYY-MM-DDTHH:MM:SS.679-0700 DEBUG [vcf_lcm,1d6ad84d0b3b1280,dc9c,upgradeId=cd0d58cc-fef3-####-####-########9e6,resourceType=NSX_T_PARALLEL_CLUSTER,resourceId=#########-##-"NSX-T FQDN":_ParallelClusterUpgradeElement,bundleElementId=db55f971-1d7e-####-####-########3b8] [c.v.e.s.l.p.c.s.LcmSecurityService,Async-10] SSL validation failed for the host <NSX-T FQDN>

YYYY-MM-DDTHH:MM:SS.680-0700 DEBUG [vcf_lcm,1d6ad84d0b3b1280,dc9c,upgradeId=cd0d58cc-fef3-####-####-########9e6,resourceType=NSX_T_PARALLEL_CLUSTER,resourceId=#########-##-"NSX-T FQDN":_ParallelClusterUpgradeElement,bundleElementId=db55f971-1d7e-####-####-########3b8] [c.v.e.s.l.p.c.s.LcmSecurityService,Async-10] Host SSL validation successful for host <NSX-T FQDN>

 

• Running the command in NSX-T Manager node shows CN as shortname

root@nsxmanager:~# echo | openssl s_client -showcerts -connect localhost:443

Environment

VMware Cloud Foundation 5.x
VMware Cloud Foundation 4.x

Cause

This occurs due to a mismatch in the Common Name(CN) field of the certificate, which is currently not using the Fully Qualified Domain Name(FQDN).

Resolution

To resolve this issue, follow the steps below:

1. Generate and install a certificate for NSX-T manager nodes which contains the FQDN in the Common Name (CN) field from SDDC manager – Refer to the Managing Certificates section in the VMware Cloud Foundation Administration Guide on Broadcom TechDocs:

   • For VCF 4.x: Managing Certificates in VMware Cloud Foundation (Administration Guide

   • For VCF 5.x: Managing Certificates in VMware Cloud Foundation (Administration Guide)
     (This section covers using the SDDC Manager UI to generate and submit CSRs and install CA-signed certificates for NSX Manager.)

2. Now run the command in the NSX-T manager node to verify the change:
   
   root@nsxmanager:~# echo | openssl s_client -showcerts -connect localhost:443 (It should now display CN=FQDN)
   
   

3. Retry the NSX-T upgrade.