Certificate API error for get_private action observed in logging post upgrade to NSX 4.X

Products

• VMware NSX

Issue/Introduction

• An upgrade to NSX 4.x has recently been carried out.
• Entries similar to the below will be encountered in /var/log/syslog in the NSX Manager support bundle:
  

  NSX 75556 SYSTEM [nsx@6876 comp="nsx-manager" errorCode="MP40304" level="ERROR" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Error in rest call. url= /nsxapi/api/v1/trust-management/certificates/?action=get_private , method= GET , response= {#012 "httpStatus" : "BAD_REQUEST",#012 "error_code" : 268,#012 "module_name" : "common-services",#012 "error_message" : "Request has unknown parameters: action."#012} , error= 400 : "{<EOL> "httpStatus" : "BAD_REQUEST",<EOL> "error_code" : 268,<EOL> "module_name" : "common-services",<EOL> "error_message" : "Request has unknown parameters: action."<EOL>}"
  
  NSX 75556 SYSTEM [nsx@6876 comp="nsx-manager" level="WARNING" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Failed to get extension certificate

• Entries similar to the below will be encountered in /var/log/cm-inventory.log in the NSX Manager support bundle:
  

  INFO http-nio-127.0.0.1-7443-exec-1 InventoryCmObjFacadeImpl 76658 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" reqId=<RequestID>" subcomp="cm-inventory" username="admin"] listComputeManagers called with parameters, origin type: null, server: null
  
  INFO http-nio-127.0.0.1-7443-exec-1 MpRestService 76658 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Getting certificate using REST API nsxapi/api/v1/trust-management/certificates/?action=get_private
  
  INFO http-nio-127.0.0.1-7443-exec-1 LoggingRestTemplate 76658 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Request::URI:http://localhost:7440/nsxapi/api/v1/trust-management/certificates/?action=get_private method:GET
  
  ERROR http-nio-127.0.0.1-7443-exec-1 MpInventoryRestClient 76658 SYSTEM [nsx@6876 comp="nsx-manager" errorCode="MP40304" level="ERROR" reqId="<RequestID>" subcomp="cm-inventory" username="admin"] Error in rest call. url= /nsxapi/api/v1/trust-management/certificates/?action=get_private , method= GET , response= {
  
    "httpStatus" : "BAD_REQUEST",
  
    "error_code" : 268,
  
    "module_name" : "common-services",
  
    "error_message" : "Request has unknown parameters: action."
  
  } , error= 400 : "{<EOL>  "httpStatus" : "BAD_REQUEST",<EOL>  "error_code" : 268,<EOL>  "module_name" : "common-services",<EOL>  "error_message" : "Request has unknown parameters: action."<EOL>}"
  
  org.springframework.web.client.HttpClientErrorException$BadRequest: 400 : "{<EOL>  "httpStatus" : "BAD_REQUEST",<EOL>  "error_code" : 268,<EOL>  "module_name" : "common-services",<EOL>  "error_message" : "Request has unknown parameters: action."<EOL>}"

• Retrieving compute manager listings may trigger the same log line ( by indirect workflow or via direct API GET /api/v1/fabric/compute-managers/ )
• No functional impact observed and no action is required if Compute Manager connectivity is working as expected.
  
  

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX 4.x

Cause

Internal workflows trigger a call to retrieve extension certificates but if the certId is empty, the URL formed is incorrect and leads to the above printed error messages. 

Resolution

This is a known issue impacting VMware NSX.

Workaround

The occurrence of this log line can be limited by reducing or preventing any external calls to retrieve Compute Manager listings.