Unable to Apply or Replace NSX Manager API Certificate (Error Code: 2158)

Products

• VMware NSX

Issue/Introduction

Starting from NSX 4.2, the NSX Manager UI offers an option to renew the certificate on the NSX Manager Node.

During certificate replacement, you may encounter the following error message:

Error: Not allowed to apply a service-type API to a CA-signed certificate without hostname check passing. (Error code: 2158)

Environment

VMware NSX

Cause

This issue can occur if the Subject Alternative Name (SAN) field information in the certificate is incorrect and/or if the hostname cannot be resolved through DNS.

Resolution

• Verify that the certificate includes the SAN field with the hostname of the individual NSX Manager node.
• Verify that every individual hostname is getting resolved by DNS through both forward and reverse lookup.