Upgrading an NSX manager appliance from NSX manager UI fails and repo sync is in failed status

Products

• VMware NSX
• VMware NSX-T Data Center

Issue/Introduction

• Failed to upgrade NSX manager
• NSX Manager UI System -> Overview page Repository Sync status is red with error "Sync Failed"
• Verify that this is not a match of Upgrading or deploying an VMware NSX Edge node or Manager appliance from NSX manager UI fails. Errors related to "curl_wrapper"
• Log prints similar to
  

  /var/log/syslog
  
  NSX 436657 - [nsx@6876 comp="nsx-manager" subcomp="curl_wrapper" username="uproton" level="INFO"] certificate verification <CERTIFICATE UUID> from <FQDN>:443 failed: SSL: no alternative certificate subject name matches target host name '<FQDN>'

Environment

VMware NSX-T Data Center
VMware NSX

 

Cause

The certificate common name (or Subject Alternative Name) applied to the node(s) is incorrect or may not be assigned to the specified FQDN of the Manager node(s).

Resolution

Correct the certificate so that the common name matches the FQDN applied to the node or there is a Subject Alternative Name entry with the FQDN.

Note: 
Make sure you include all of the DNS records for the managers. You can either check the DNS server if you manage it, or perform a dig or nslookup against the NSX manager nodes IP multiple times to verify.
If you don't include all of them, including their IPs, repo_sync will fail.

Additional Information

NSX Administration Guide - Certificates