NSX Edge Upgrade fails at Precheck with error - Unable to initialize, java.io.IOException: Short read of DER length. Please delete (if unused) or replace this certificate prior to upgrading.

Products

• VMware NSX

Issue/Introduction

During a pre-upgrade check on NSX Edges, an error is showing within the GUI of the pre-check stating :
The certificate with id 8441####-eee6-####-9fa0-######b6a86e failed to parse with error: Unable to initialize, java.io.IOException: Short read of DER length. Please delete (if unused) or replace this certificate prior to upgrading.


Environment

VMware NSX
VMware NSX-T Data Center

Cause

• Certificate has private key contained within it. When you export the certificate with that ID (in the error) , you can see the Private Key in the Content of the Certificate:
  
  

  -----BEGIN ENCRYPTED PRIVATE KEY-----
  MIIFJ
  uf1i2UEW
  -----END ENCRYPTED PRIVATE KEY-----
  -----BEGIN CERTIFICATE-----
  MIIGYTC.
  5VRrvmc=
  -----END CERTIFICATE-----
  -----BEGIN CERTIFICATE-----
  MIID6DCC
  AYXQWd+aTEUPBbgwY=
  -----END CERTIFICATE-----

• Certificate may have been imported along with the key value in 'Certificate Contents'.
  
  

Resolution

• Replace the certificate  (Make sure to separate certificate and key in the specified options as mentioned in VMware NSX Admin Guide - Import a Self-signed or CA-signed Certificate. )
• Alternatively you can delete the faulty certificate if is not required or in use.
• Retry the upgrade prechecks.