Unable to get security licenses from License Hub
Article ID: 414011
Updated On:
Products
Issue/Introduction
Licenses could not be fetched from License Hub.
Environment
vDefend SSP >= 5.2
Cause
Security Services platform is not able to connect to License Hub to fetch the latest licenses.
For more details, please refer to logs using following steps.
Execute these on SSPI
#check the licensing-client-service pod
k -n nsxi-platform get pods | grep "licensing-client-service"
#see the logs for licensing-client-service pod
k -n nsxi-platform logs -f deployment/licensing-client-service | grep -i "endpoint_refresh_license_impl.go"
Sample error message:
#Error handler triggered
INFO License refresh error handler called - raising alarm
#Alarm sent successfully
INFO Successfully sent license refresh alarm message to metrics-manager status=DISCONNECTED
Resolution
Please review and restore the connectivity between License Hub and Avi Cloud Console.
Step 1: Identify the License Hub FQDN
licensing-client-service does not use a hardcoded hostname — it reads the target License Hub endpoint from the SspInfo custom resource on the SSP cluster.
Log in to the SSP-Installer using sysadmin credentials, then run:
k get sspinfo -n nsxi-platform -o yaml
Note the spec.ingressHostname value — this is the FQDN licensing-client-service uses to reach License Hub.
Step 2: Identify the licensing-client-service Pod and Node
Find the pod and the worker node it's scheduled on:
k get pods -n nsxi-platform -l app.kubernetes.io/name=licensing-client-service -o wide
Note the NODE column (Internal-IP can be cross-referenced with k get nodes -o wide).
Step 3: Validate Connectivity to License Hub
Preferably, test directly from the pod itself (this reflects actual pod egress/DNS/proxy behavior):
k exec -n nsxi-platform -it <licensing-client-service-pod> -- curl -v https://<License-Hub-FQDN>:443
If the pod image lacks curl/nc, SSH to the worker node identified in Step 2 instead:
ssh capv@<Worker-Node-IP>
Option A: Using Netcat (Quick Port Check)
nc -zv <License-Hub-FQDN> 443
Expected Result: Connection to <License-Hub-FQDN> 443 port [tcp/https] succeeded!
Option B: Using cURL (Verify SSL/mTLS Handshake)
curl -v https://<License-Hub-FQDN>
Expected Result: You should see a Connected to... message and the SSL certificate exchange. Since licensing-client-service uses mutual TLS, a 403 Forbidden, 401 Unauthorized, or certificate-related rejection from the server is actually a SUCCESS — it proves the traffic reached License Hub. A connection timeout or Could not resolve host indicates the actual network/DNS problem.
Once connectivity is restore, the consolidated usage reporting will be reattempted in the next automated reporting cycle (default 1 hour). When this operation is successful, the alarm will be resolved.
Feedback
