NSX Compute Manager Registration Errors After vCenter Certificate Renewal Due to vpxd Certificate Mismatch

Products

VMware NSX VMware vCenter Server

Issue/Introduction

After renewing or replacing the SSL certificate on a vCenter Server that is registered as a Compute Manager in NSX-T, the vCenter Compute Manager may fail to register successfully or may not maintain a healthy connection with NSX.

Initially, NSX reports a thumbprint mismatch error indicating that the SSL certificate has changed. Even after updating the thumbprint and resolving this error, additional certificate-related issues may persist.

Compute Manager <########> can not be connected, as its thumbprint does not match. Please edit compute manager details if thumbprint is changed.

Subsequently, operations such as removing NSX ownership or re-establishing trust with the Compute Manager may fail with SSL handshake errors, including PKIX path building failures, indicating that the certificate chain cannot be validated.

Failed to remove NSX ownership due to error Error in rest call. url= nsxapi/api//v1/managed-objects/lcm/nsx-ownership/####-#####-#########?action=clear , method= PUT , response= { "module_name" : "common-services", "error_message" : "General error has occurred.", "details" : "java.lang.RuntimeException: com.vmware.vim.vmomi.client.exception.SslException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: java.security.cert.CertPathBuilderException: Unable to find certificate chain.", "error_code" : 100 } , error= 500 : "{<EOL> "module_name" : "common-services",<EOL> "error_message" : "General error has occurred.",<EOL> "details" : "java.lang.RuntimeException: com.vmware.vim.vmomi.client.exception.SslException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: java.security.cert.CertPathBuilderException: Unable to find certificate chain.",<EOL> "error_code" : 100<EOL>}<EOL>" .. Please resolve the error and try again.

Furthermore, even after updating the Compute Manager credentials (username and password) from the NSX UI, NSX may continue to report that the Compute Manager certificate chain is invalid, citing issues with the certificate issuer or subject.

Certificate chain of Compute Manager ##### is invalid. Please check Issuer and Subject in the chain. (Error code: 90204)

Environment

VMware NSX-T Data Center
VMware vCenter Server

Cause

The primary cause is that the vpxd service within the vCenter Server Appliance is still utilizing the old, expired, or replaced SSL certificate, even though the main HTTPS service (rhttpproxy) might be presenting the new, valid certificate. This internal inconsistency leads to a thumbprint mismatch when NSX attempts to validate the vCenter's certificate for the Compute Manager connection, resulting in registration failures.

- From the logs, we can see the same thumbprint being used on NSX and we still see that the certificate being expired.

cm-inventory.log

"/cm-inventory/api/v1/fabric/compute-managers": {
    "result_count": 1,
    "results": [
      {
        "_create_time": <timestamp>,
        "_create_user": "system",
        "_last_modified_time": <timestamp>,
        "_last_modified_user": "<username>",
        "_protection": "NOT_PROTECTED",
        "_revision": 30,
        "access_level_for_oidc": "FULL",
        "create_service_account": false,
        "credential": {
          "credential_type": "UsernamePasswordLoginCredential",
          "thumbprint": "20:E3:xx:xx:xx:xx:xx:xx:xx:xx:xx:7B:74:49:4F:EC:CC:94" <<< New certificate thumbprint
        },
        "description": "",
        "display_name": "<vCenter_name>",
        "id": "8bd1####-####-####-####-####67fd5b4e",
        "multi_nsx": false,
        "origin_properties": [
          {
            "key": "fullName",
            "value": "VMware vCenter Server 8.0.3 build-24305161"
          },

           "key": "instanceUuid",
            "value": "5429####-####-####-####-####b5c41eae"
       "origin_type": "vCenter",
        "resource_type": "ComputeManager",
        "reverse_proxy_https_port": 443,
        "server": "<vCenter_name>",
        "set_as_oidc_provider": true

status:

  "/cm-inventory/api/v1/fabric/compute-managers/8bd1####-####-####-####-####67fd5b4e/status": {
    "connection_errors": [
      {
        "error_code": 0,
        "error_message": "Compute Manager <vCenter_name> certificate is expired. Please renew it and edit Compute Manager to update its thumbprint in NSX.",
        "timestamp": <timestamp>
      }
    ],
    "connection_status": "DOWN",
    "last_sync_time": <timestamp>,
    "oidc_end_point_id": "2dbee45######################################2803f5f361f7",
    "registration_errors": [
      {
        "error_code": 90325,
        "error_message": "Failed to remove NSX ownership due to error Error in rest call. url= nsxapi/api//v1/managed-objects/lcm/nsx-ownership/8bd1####-####-####-####-####67fd5b4e?action=clear , method= PUT , response= {\n \"module_name\" : \"common-services\",\n \"error_message\" : \"General error has occurred.\",\n \"details\" : \"java.lang.RuntimeException: com.vmware.vim.vmomi.client.exception.SslException: javax.net.ssl.SSLHandshakeException: Certificate expired for C=US,CN=<vCenter_name>\",\n \"error_code\" : 100\n}\n , error= 500 : \"{<EOL> \"module_name\" : \"common-services\",<EOL> \"error_message\" : \"General error has occurred.\",<EOL> \"details\" : \"java.lang.RuntimeException: com.vmware.vim.vmomi.client.exception.SslException: javax.net.ssl.SSLHandshakeException: Certificate expired for C=US,CN=<vCenter_name>\",<EOL> \"error_code\" : 100<EOL>}<EOL>\" .. Please resolve the error and try again.",
        "timestamp": <timestamp>
      }
    ],
    "registration_status": "REGISTERED_WITH_ERRORS",
    "version": "8.0.3"
  },

On the vCenter, the certificate under /etc/vmware-vpx/ssl/rui.crt did not match with the actual certificate which was changed.

Use command to validate the certificate on the vCenter server.
openssl x509 -in /path/certificate.crt -text -noout

Resolution

Validate the certificate under /etc/vmware-vpx/ssl/rui.crt. If the certificate is not valid and does not match the replaced certificate open a case with Broadcom support (vCenter component) with the following details.

- NSX support bundle
- vCenter support bundle.