NSX Edge transport Node shows MPA disconnected on NSX GUI after replacing internal certificates in NSX 4.x - VMware NSX

Products

• VMware NSX

Issue/Introduction

• After renewing internal certificates on NSX Managers, which were expiring soon, the Edge Transport Nodes remained in MPA disconnected state. 
• NSX Edge VMs are reachable and the ports required for communication with NSX managers (1234, 1235, 443) confirm to be open and reachable. 
• All the NSX Managers shows standby when executed get managers command:

• /var/log/syslog on the Edge nodes shows "sslv3 certificate unknown" as below:

  ####-##-##T##:##:##.###Z <NSXedge-name> NSX 7216 - [nsx@6876 comp="nsx-edge" subcomp="nsx-proxy" s2comp="nsx-net" tid="7236" level="WARNING"] StreamConnection[385 Connecting to ssl://<NSX_Manager_IP>:1235 sid:385] Couldn't connect to 'ssl://<NSX_manager_IP>:1235' (error: 336151574-sslv3 alert certificate unknown

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX

Cause

When the Edge Node certificates can't be updated by the NSX managers due to a failure on the Edge Node, this might result in an  inconsistent state of Edge Node.

Resolution

This is a condition that may occur in a VMware NSX environment.

 

Workaround

Perform below actions on the failed Edge Node: 

1. Get the certificate thumbprint from any NSX manager executing command 

• • get certificate api thumbprint

     2. On the Edge node, in the admin prompt, execute below to sync certificates and restart nsx-proxy 

• • push host-certificate <manager-IP-FQDN:port> username <username> thumbprint <cert-api-thumbprint-of-manager> password <password>
  • sync-aph-certificates <NSX-Manager-IP> username admin thumbprint <thumbprint> password <password>
  • /etc/init.d/nsx-proxy restart
    • Must be ran in the root of the Edge Node 
  • /etc/init.d/nsx-opsagent-appliance restart
    • Must be ran in the root of the Edge Node 

 

Additional Information

If the issue still persists on the Edge node, perform below actions 

Backup existing certificate and private key and remove them from the edge node as below 

• cp /etc/vmware/nsx/host-cert.pem  /etc/vmware/nsx/host-cert.pem.old
• cp /etc/vmware/nsx/host-privkey.pem /etc/vmware/nsx/host-privkey.pem.old
• rm -f  /etc/vmware/nsx/host-cert.pem /etc/vmware/nsx/host-privkey.pem

Get the certificate thumbprint from any NSX manager executing command 

• • get certificate api thumbprint

Execute push host-certificate and sync-aph-certificates to the NSX Manager and restart nsx-proxy and nsx opsagent as below:

• push host-certificate <manager-IP-FQDN> username <username> thumbprint <cert-api-thumbprint-of-manager> password <password>
• sync-aph-certificates NSX-Manager-IP username admin thumbprint <thumbprint> password <password>
• /etc/init.d/nsx-proxy restart
  • Must be done from root
• /etc/init.d/nsx-opsagent-appliance restart
  • Must be done from root

 

Other KBs related to similar issue;

NSX Transport Nodes disconnect after replacing certificates with replace_certs.py in NSX 4.1.x

ESXi Host's NSX Configuration status shows Host Disconnected in NSX UI

NSX Configuration in Host Transport Node shows failed after certificate replacement

Alarm For Transport Node Certificate Has Expired.