HCX appliance does not auto-renew its self-signed certificate, even after an upgrade

Products

• VMware HCX

Issue/Introduction

• HCX Connector or Manager does not automatically generate a new self-signed certificate after the original certificate expires that was generated at the time of HCX deployment, even after upgrade.
• HCX Manager continue to function with the expired certificates.
• The Certificate validity is verified on the HCX Manager Admin UI on port https://<hcx-manager-fqdn>:9443 by logging in as admin and navigating to Administration --> Certificate --> Trusted CA Certificate

Environment

VMware HCX 4.x

Cause

• HCX Managers running on versions older than 4.4 lacks the automated task that periodically checks for expired certificate and initiating its automatic replacement.

Resolution

• The appliance certificate can still be manually replaced by following the documentation here -->  Updating the Local Server Certificate on an HCX Manager.
• The following steps are for HCX Manager builds 4.11+.

To update the self-signed certificate of HCX Manager via script, use the method below:

1. Please download the 2 files attached to this KB: 
   • replaceSelfSignedCert.sh
   • cert_req.cnf.template
2. Copy these 2 files to HCX Managers /tmp directory. 
3. From the HCX Manager /tmp directory, run the following commands:
   • chmod +x cert_req.cnf.template
   • chmod +x replaceSelfSignedCert.sh
   • ./replaceSelfSignedCert.sh

 

Additional Information

• HCX Transport Analytics fails with "A firewall is preventing the ICMP traffic" after HCX Manager IP change