Error: MPA connectivity down on Edge or Host Transport Node - VMware NSX

Products

• VMware NSX

Issue/Introduction

• NSX Edge or ESXi Host Transport Nodes appear in a failed or disconnected state in the NSX Manager UI, seen as 'MPA Connectivity Down' in the Edge Transport node configuration state. This issue typically occurs when the management plane agent (MPA) cannot establish a secure connection.
  
  
  
• Manager and controller connectivity is not established even with reachability between the Transport Node and the Managers (for Edge nodes the reason may also be reported as OTHER_ERROR or CONTROLLER_REJECTED_HOST_CERT):
  

  nsxcli -c get managers
  Wed Sep 24 2025 UTC 03:05:44.948
  - 10.#.#.21    Standby (NSX-RPC)
  - 10.#.#.22    Standby (NSX-RPC)
  - 10.#.#.23    Standby (NSX-RPC) *
  
  nsxcli -c get controllers
  Wed Sep 24 2025 UTC 03:05:55.941
   Controller IP    Port     SSL         Status       Is Physical Master   Session State  Controller FQDN           Failure Reason
   10.#.#.23    1235   enabled    disconnected           true              down              NA                       NA
   10.#.#.22    1235   enabled      not used            false              null              NA                       NA
   10.#.#.21    1235   enabled      not used            false              null              NA                       NA

• Messages similar to the following are seen in the ESX i var/run/log/nsx-syslog.log file
  

  Wa(180) nsx-proxy[2101991]: NSX 21####1 - [nsx@6876 comp="nsx-esx" subcomp="nsx-proxy" s2comp="nsx-net" tid="2102015" level="WARNING"] Certificate validation: couldn't find SHA256 digest '####################################' in local trust store
  Er(179) nsx-proxy[2101991]: NSX 21####1 - [nsx@6876 comp="nsx-esx" subcomp="nsx-proxy" s2comp="nsx-net" tid="2102015" level="ERROR" errorCode="NET1111"] Certificate validation failed: 18-self signed certificate
  
  In(182) nsx-opsagent[2102367]: NSX 21###67 - [nsx@6876 comp="nsx-esx" subcomp="mpa-client" tid="21###30" level="INFO"] [AlarmsProvider] MsgHandler : Invalid stub for Master APH
  In(182) nsx-opsagent[2102367]: NSX 21###67 - [nsx@6876 comp="nsx-esx" subcomp="mpa-client" tid="21###30" level="INFO"] [AlarmsProvider] SendRequest: Failed to send msg Master APH, Publish, type (com.vmware.nsx.monitoring.CollectorMpMsg), correlationId (), trackingIdStr (#######-####-####-3fa3-########a1e0), ret (-1)

• Messages similar to the following are seen in the NSX Manager /var/log/syslog file

  Manager01 NSX 99086 SYSTEM [nsx@6876 comp="nsx-manager" level="WARNING" subcomp="manager"] getStub: client ########-####-####-####-############, application HealthCheck, java.util.concurrent.ExecutionException: java.util.concurrent.TimeoutException: Channel ClientChannel(vmware.nsx.healthcheck.HealthCheckHostService, ########-####-####-####-###########) is closed before stream was opened due to Status(code=UNKNOWN, msg=Closed by remote service)
  2025-09-24T02:50:00.327Z Manager01 NSX 99086 MONITORING [nsx@6876 comp="nsx-manager" errorCode="MP150008" level="ERROR" subcomp="manager"] Error in sending requestMsg to transportNode:########-####-####-####-#############, requestId(roundId): left: #######################right: #####################, errInfo:Unable to reach client ########-####-####-####-###########, application HealthCheck

  
  

Environment

• VMware NSX 4.x
• VMware Cloud Foundation (VCF)

Cause

The Transport Node (TN) host certificate (host-cert.pem) has expired, breaking the mutual trust relationship with the NSX Manager cluster.

Resolution

1. SSH into the affected Edge or Host as the root user.
2. If on an Edge node, elevate to engineering mode: st en
3. Check the certificate host-cert.pem.
   

   cd /etc/vmware/nsx/

   Sample output:

   appliance-info.xml   host-cert.pem  host-privkey.pem  netopa.xml     openssl-proxy.cnf
   controller-info.xml  host-cfg.xml   mpa-txn           nsx-proxy.xml

4. Backup the existing certificate:
   

   cp host-cert.pem host-cert.pem.bak

5. Delete the expired certificate:
   

   rm host-cert.pem

6. Restart the proxy service to regenerate the certificate: host-cert.pem file.
   

   /etc/init.d/nsx-proxy restart

7. Verify the new certificate (.pem) file:
   

   openssl x509 -startdate -enddate -noout -in /etc/vmware/nsx/host-cert.pem

8. Push the new certificate to all Manager nodes by performing a manual resync for all three manager nodes (OR refer work around in KB: 389595

   push host-certificate <manager-IP-FQDN> username <username> thumbprint <cert-api-thumbprint-of-manager> password <password>
   sync-aph-certificates <manager-IP-FQDN> username <username> thumbprint <cert-api-thumbprint-of-manager> password <password>

9. Check the Transport Nodes status in the NSX UI

Additional Information

To prevent this condition from triggering, it is recommended to act upon TN Certificate Expiry alarms rapidly: KB 345825

A similar condition can also be caused by an incorrect FQDN configured on the TN for the NSX Managers: KB 404627

For automated remediation, refer to the CARR script in KB 369034

To stay updated on this issue, subscribe to this Article.