HCX Interconnect (IX) Deployment Failures: OvfNetworkMappingNotSupported and Certificate Generation Issues

Products

• VMware HCX

Issue/Introduction

During HCX Interconnect (IX) appliance deployment or redeployment operations, administrators may encounter failures related to OVF network mapping and certificate generation. These issues can manifest as network mapping errors during deployment or certificate signing request failures.

• On the vCenter GUI login, we see the following certificate error "Certificate Signing Request Error:"

Generate a certificate signing request using the specified Distinguished Name Status: Access to perform the operation was denied. The IX deployment fails with the error below. This can be checked at vCenter --> IX VM --> Monitor --> Tasks  

• Appliance operation failed for appliance Id <id> with error Redeploy of Interconnect Appliance failed. Interconnect Service Workflow InterconnectRedeploy failed. Error: Deploy and Configuration of Interconnect Appliances Failed. Interconnect Service Workflow DeployAppliance failed. Error: Interconnect Service Workflow OvfUpload failed. Error: Errors encountered during ImportSpec creation: com.vmware.vim.binding.vim.fault.OvfNetworkMappingNotSupported The provided network mapping between OVF networks and the system network is not supported by any host. Cause: null.


Environment

• VMware HCX Interconnect (IX) appliances
• VMware vSphere environments with HCX deployed

Cause

These deployment failures typically occur due to the following conditions

1. Certificate Generation Failures
   • Misaligned network configurations preventing proper communication between HCX components
   • Network backing issues affecting certificate authority access
   • Incorrect network mappings affecting service communication
2. OVF Network Mapping Failures
   • Network backing configuration mismatches between defined network profiles and actual vSphere networking
   • Inconsistent network mapping information between source and target sites
   • Outdated network configuration information in the service mesh

Resolution

Follow these steps to resolve the IX appliance deployment issues

1. Primary Resolution Path
   • Perform a service mesh resync operation from the source/connector side
   • This updates network backing information across both sites
   • After resync completes, attempt IX appliance redeployment
   • Verify certificate generation and network mapping succeed
2. Alternative Resolution Steps
   • If issues persist, verify network profile configurations match actual vSphere networking
   • Ensure all required network backings are available on deployment clusters
3. Post-Resolution Verification
   • Confirm IX appliance deploys successfully
   • Verify certificate generation completes
   • Test network connectivity across all configured networks
   • Validate service mesh status shows healthy