Alarm For Transport Node Certificate is About to Expire.

Products

• VMware NSX

Issue/Introduction

Title: transport_node_certificate_is_about_to_expire
Event ID: transport_node_certificate_is_about_to_expire
Alarm Description

• Purpose: Notify Users that Transport Node Certificate is about to expire in 7 days or less.
• Impact: Transport Node can disconnect from Managers and not connect back again after the certificate expiry.
• Cause: Transport Node certificate is about to expire in 7 days or less.
• Location: Alarms are present in the NSX UI and Aria Operations UI.

Warning: This alarm must be addressed as soon as possible. Once the TN certificate expires, there is a grace period of 24 hours after which all impacted Edges and Hosts will be disconnected from NSX.

• Validate the expiry date of the certificate on the Host or Edge by running this command as root user:
  openssl x509 -enddate -noout -in /etc/vmware/nsx/host-cert.pem.

Environment

VMware NSX

Cause

• NSX 4.1.x and 4.2.0, Edge and Host Transport Nodes are incorrectly instantiated using a certificate with validity period of 825 days.
• NSX-T 3.x and NSX 4.2.1 and higher create Transport Nodes using a certificate with validity period of 10 years.
• By design the Transport Node certificate used at create time is not replaced on upgrade.
• As a result any Edge that may have been deployed or any Hosts prepared or re-prepared on these impacted versions will have this shorter validity period certificate.

Resolution

Follow the appropriate resolution step:

1) Transport Node has a certificate that has not yet expired:

• The CARR script can be used to replace the TN certificates. See Using Certificate Analyzer, Results and Recovery (CARR) Script to fix certificate related issues in NSX.

or

2) This "About to Expire" alarm has been ignored and the Transport Node certificate has expired and TN is in a disconnected state in NSX:

• Follow the Resolution steps in Alarm For Transport Node Certificate Has Expired - Host/Edges MPA Disconnected.

Additional Information

• Internal error reported when running the NSX cli push host-certificate