Certificate API error for get_private action observed in logging post upgrade to NSX 4.X

Products

• VMware NSX

Issue/Introduction

• An upgrade to NSX 4.x has recently been carried out.
• Entries similar to the below will be encountered in /var/log/syslog in the NSX Manager support bundle:
  

  NSX 75556 SYSTEM [nsx@6876 comp="nsx-manager" errorCode="MP40304" level="ERROR" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Error in rest call. url= /nsxapi/api/v1/trust-management/certificates/?action=get_private , method= GET , response= {#012 "httpStatus" : "BAD_REQUEST",#012 "error_code" : 268,#012 "module_name" : "common-services",#012 "error_message" : "Request has unknown parameters: action."#012} , error= 400 : "{<EOL> "httpStatus" : "BAD_REQUEST",<EOL> "error_code" : 268,<EOL> "module_name" : "common-services",<EOL> "error_message" : "Request has unknown parameters: action."<EOL>}"
  
  NSX 75556 SYSTEM [nsx@6876 comp="nsx-manager" level="WARNING" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Failed to get extension certificate

• Entries similar to the below will be encountered in /var/log/cm-inventory/cm-inventory.log in the NSX Manager support bundle:
  

  INFO http-nio-127.0.0.1-7443-exec-1 InventoryCmObjFacadeImpl 76658 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" reqId=<RequestID>" subcomp="cm-inventory" username="admin"] listComputeManagers called with parameters, origin type: null, server: null
  
  INFO http-nio-127.0.0.1-7443-exec-1 MpRestService 76658 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Getting certificate using REST API nsxapi/api/v1/trust-management/certificates/?action=get_private
  
  INFO http-nio-127.0.0.1-7443-exec-1 LoggingRestTemplate 76658 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Request::URI:http://localhost:7440/nsxapi/api/v1/trust-management/certificates/?action=get_private method:GET
  
  ERROR http-nio-127.0.0.1-7443-exec-1 MpInventoryRestClient 76658 SYSTEM [nsx@6876 comp="nsx-manager" errorCode="MP40304" level="ERROR" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Error in rest call. url= /nsxapi/api/v1/trust-management/certificates/?action=get_private , method= GET , response= {
  
    "httpStatus" : "BAD_REQUEST",
  
    "error_code" : 268,
  
    "module_name" : "common-services",
  
    "error_message" : "Request has unknown parameters: action."
  
  } , error= 400 : "{<EOL>  "httpStatus" : "BAD_REQUEST",<EOL>  "error_code" : 268,<EOL>  "module_name" : "common-services",<EOL>  "error_message" : "Request has unknown parameters: action."<EOL>}"
  
  org.springframework.web.client.HttpClientErrorException$BadRequest: 400 : "{<EOL>  "httpStatus" : "BAD_REQUEST",<EOL>  "error_code" : 268,<EOL>  "module_name" : "common-services",<EOL>  "error_message" : "Request has unknown parameters: action."<EOL>}"

• Retrieving compute manager listings may trigger the same log line ( by indirect workflow or via direct API GET /api/v1/fabric/compute-managers/ )
• No functional impact observed and no action is required if Compute Manager connectivity is working as expected.
  
  

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX

Cause

Internal workflows trigger a call to retrieve extension certificates but if the certId is empty, the URL formed is incorrect and leads to the above printed error messages. 

Resolution

This issue is resolved in VMware NSX 4.2.2 and 9.0.0, available at Broadcom downloads.

Workaround

The occurrence of this log line can be limited by reducing or preventing any external calls to retrieve Compute Manager listings.