In SDDC Manager NSX accounts are disconnected and remediation fails with errors related to SSL handshake and certificate path validation(PKIX path validation failed) or certificate_unknown(46)

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

Complete Error message in the failed task: 

Cause: I/O error on GET request for "https://<NSX_FQDN>/api/v1/node/users": PKIX
path validation failed: java.security.cert.CertPathValidatorException: validity check failed;
nested exception is javax.net.ssl.SSLHandshakeException: PKIX path validation failed:
java.security.cert.CertPathValidatorException: validity check failed (or certificate_unknown(46))

Environment

VMware Cloud Foundation 4.x

VMware Cloud Foundation 5.x

Cause

The issue occurs when the NSX Manager certificate has expired or is untrusted [certificate_unknown(46)]
SDDC Manager relies on certificate validation for secure API communication, and an expired or untrusted certificate prevents remediation tasks from completing successfully.

Resolution

1. Validate the certificate of the NSX manager either from the NSX UI or Workload Domain> Certificates.
2. If the certificates are expired or self-signed replace them with VC signed certificates using the below KB: Scripted process to Replace Expired or Self-signed VMware NSX-T Manager Certificates with VMCA-Signed Certificates
3. Once the certificates are replaced re-run the remediation task with the same(current/working) password to fix the disconnect status. 
4. In case you are using custom certificates replace with VMCA-Signed Certificates then change them from SDDC manager. 

Additional Information

Other possible issues where NSX can be disconnected:
 NSX-T Manager user accounts disconnected in SDDC Manager password management