Password Remediation for NSXT Manager's root and admin accounts fail with an error 'Falled to get NSXT user details'

Products

• VMware SDDC Manager

Issue/Introduction

Below message we see in Task error details,

Cause: VO error on GET request for "https://nsxmanagerclusterfqdn/api/v1/node/users": PKIX path validation faled:
ava security cert.CertPathValidatorxception: validity check failed; nested exception is
avax.net ssl.SSLHandshakeException PKK path valdation faled:
ava securiky cert CertPathValdatorException: validty check falled

Environment

VCF 5.1.x

VCF 5.2.x

Cause

NSXT Managers certificates are expired.

It can be confirmed on the certificates tab under Domain view in SDDC UI.

We can also confirm by viewing certificate from browser for the NSXT Manager URL.

 

 

Resolution

Certificates from NSXT Manager UI needs to be replaced to self signed.

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-5-2-and-earlier/5-1/vmware-cloud-foundation-operations-5-1/vcf-best-practices-operations/certificate-operations-operations/replace-nsx-manager-expired-certificates-operations.html

Once the self signed certs are install and are ACTIVE in SDDC we can replace the CA certificates again from SDDC UI as specified in below doc,

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-5-2-and-earlier/5-1/vcf-on-vxrail-complete-5-1/certificate-management-VxRail.html