Certificate chain of compute manager is invalid, please check issuer and subject in the chain went replacing a CA cert on the Vcenter
Article ID: 372076
Updated On:
Products
Issue/Introduction
- When the machine SSL certificate on a vCenter Server is updated or replaced with a new custom machine SSL certificate, NSX will need to validate the new certificate in order to reestablish a connection with the vCenter. The following error message may be encountered:
"Certificate chain of Compute Manager <FQDN> is invalid. Please check Issuer and Subject in the chain. (Error code: 90204)"
- A similar error can be found in the cm-inventory.log file:
2024-06-24T19:45:24.327Z ERROR http-nio-127.0.0.1-7443-exec-2 VcPlugin 4732 SYSTEM [nsx@6876 comp="nsx-manager" errorCode="MP40219" level="ERROR" reqId="11111111-2222222-7e7e7e7e7" subcomp="cm-inventory" username="admin"] Certificate of Vc VMware.org is invalid. it might be caused by issuer not being same as subject of next certificate in certificate chain.
Environment
- vCenter Server 7.x
- vCenter Server 8.x
- VMware NSX-T
Cause
The certificate chain of the custom machine SSL certificate on the vCenter may be incomplete, or there could be an incorrect or missing entry within the new certificate.
For example, the Subject Alternative Name section of the custom machine SSL certificate will need to include the FQDN, short name, and IP address of the vCenter Server. If the IP address is not included in the Subject Alternative Name (SAN) section of the custom machine SSL certificate, NSX will not be able to validate the connection to the vCenter Server, resulting in this error message.
Another possibility is that the machine SSL certificate only uses the 'leaf' certificate and not the 'full certificate chain', which includes the intermediate CA(s) and root CA.
Resolution
This is a condition that may occur in a VMware NSX environment.
Workaround
- Verify if the thumbprint shown by NSX matches the thumbprint provided by the vCenter, by running the following command on the vCenter Server:
echo | openssl s_client -connect localhost:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256 - The following command can be used to list the certificate chain from the vCenter:
openssl s_client -showcerts -debug -connect <VC-IP>:443 - If the thumbprint is a match, then the machine SSL certificate on the vCenter should be reviewed for any missing or incorrect information. If an issue is found with the machine SSL certificate currently in use on the vCenter, then a new custom certificate will need to be generated from the Certificate Authority (CA) to replace the problematic certificate on the vCenter.
Additional Information
KB articles that may assist with this process:
After VMware vCenter Server certificate is replaced, compute manager connection is "Down" on NSX UI
Feedback
