NSX Certificate Expiration Approaching Alarm

Products

• VMware NSX

Issue/Introduction

Title: Certificate Expiration Approaching

Event ID: certificate_expiration_approaching

Alarm Description: Certificate {entity_id} is approaching expiration in 30 days or less

• On the NSX UI, System > Certificates, one or more certificates have an approaching Expire Date.
  
  
• This can include any platform certificate used by the NSX Managers such as CBM, API, APH, or cluster certificates

Environment

VMware NSX-T Data Center
VMware NSX 4.x

Cause

A certificate in the NSX Manager trust store is due to expire in the next 30 days. The alarm triggers when the certificate 'Not Valid After' date is less than 31 days.

Details on the types of certificates can be found here Certificates for NSX and NSX Federation

Resolution

Identify if the certificate is self-signed or CA-signed before proceeding with renewal.

1. Verify Certificate Status

Navigate to System > Certificates and check the Used By column.

• If Used By is 0: Select the certificate and click Delete.
• If Used By is greater than 0: Proceed to renewal steps below.

2. Renew Self-Signed Certificates

Option A: NSX 4.2.0 and Higher (UI-Based)

Use the built-in renewal feature:

1. Navigate to System > Certificates.
2. Select the expiring certificate.
3. Select Actions > Replace Certificates.
4. Follow the prompts to generate and apply the new certificate.

Note: Refresh the browser session after replacing API or VIP (tomcat) certificates.

Option B: NSX 4.1.x and Older (Script-Based)

Use the Certificate Analyzer, Results and Recovery (CARR) script to automate renewal:

1. Download the CARR script attached to Using Certificate Analyzer, Results and Recovery (CARR) Script to fix certificate related issues in NSX.
2. Upload the script to the NSX Manager via SCP.
3. Execute the script via CLI to detect and replace expired self-signed certificates.

3. Renew CA-Signed Certificates

1. Generate a new CSR or obtain a new certificate from the organization's Certificate Authority.
2. Import the new certificate into NSX under System > Certificates > Import.
3. Use the API or UI (if supported in your version) to swap the certificate service binding.

Note:

• If in use, expired certificates must be replaced with valid certificates.
• Services may be functionally impacted until the certificates are replaced.
• Expired certificates that are no longer in use must be deleted.

Additional Information

Also see Alarms Indicating CBM Certificates Have Expired or Are Expiring Prevent NSX Manager Upgrades