NSX Manager prechecks fails with error "signed fields invalid. Please delete (if unused) or replace this certificate prior to upgrading."

Products

• VMware NSX

Issue/Introduction

During NSX Manager upgrade, the precheck for NSX Manager fails with the following error:

     The certificate with id xxxxxx-xxxx-xxxx-xxxx-xxxxxxxx failed to parse with error : signed fields invalid. Please delete (if unused or replace this certificate prior to upgrading).

This error typically occurs when a malformed certificate is present, which can be due to various reasons, including expired certificates, certificates with invalid fields or certificates tied to unused or obsolete identities (like an NCP user).

Environment

VMware NSX 
VMware NSX-T Data Center

Cause

The root cause of the issue is a malformed or invalid certificate, which leads to the precheck failure with the fail to parse error.

 

Resolution

The specific certificate identified in the error can be reviewed for expiration from the GUI. If not expired, the certificate can then exported to the PEM file from the certificate page within the GUI and then reviewed for correctness by decoding using SSL tools. Once the cause of the certificate invalidity is identified the certificate can be replaced with a correct format or unexpired version. Alternatively if the certificate is not in use, it can simply be deleted.

This process of replacement can be different depending on the NSX versions, with 4.2 offering auto automatic replacement options for certain certificates. Steps can be reviewed in the admin guide pages listed below.

NSX 4.2 - Replace Certificates 
NSX 4.1 - Replace Certificates