Certificate Key-Pairs used by the NSX-T Manager in NSX-T 4.2.0 G.A. and later

Products

VMware NSX

Issue/Introduction

This article outlines the X509 certificate key-pairs that are in use in NSX-T 4.2.0 G.A. and later. There is also a table of certificates that have been deprecated as of 4.2.0 G.A.

Environment

VMware NSX

Resolution

NSX-T certificates that are valid as of NSX-T 4.2.0 G.A.

	Service Type(This is the name to use for all external documentation)	Application	Alias	(Default) algorithm keysize	Port	Client/Server	Description	Replaceable via UI	Expiry time
1	API	Reverse Proxy	tomcat	RSA 2048	443	Server	API server certificate for NSX Manager node	Y	825 days
2	MGMT_CLUSTER (aka VIP)	Reverse Proxy	mp-cluster	RSA 2048	443	Server	API server certificate for NSX Manager VIP	Y	825 days
3	APH_TN	Appliance Proxy		RSA 2048	1234	Server and Client	Appliance Proxy server public key	Y	3650 days
4	APH (aka APH_AR)	Appliance Proxy		RSA 2048	1236	Server	AR server public key	Y	825 days
5	CLIENT_AUTH (aka PI)	UA	PI alias	RSA 2048	443	Client	API client certificates for Principal Identity (no keys)	Y	Customer decides
6	LOCAL_MANAGER	UA	LocalManager	RSA 2048	443	Client	LocalManager Principal Identity certificate used to communicate with other sites in Federation	Y	825 days
7	GLOBAL_MANAGER	UA	GlobalManager	RSA 2048	443	Client	GlobalManager Principal Identity certificate used to communicate with other sites in Federation	Y	825 days
8	CBM_CLUSTER_MANAGER	CBM	self	RSA 2048	9000	Client	Corfu Client Certificate	Y	100 years
9	CBM_CORFU	CBM	self	RSA 2048	client port	Server	Corfu server certificate	Y	100 years
10	CCP	CCP	self	RSA 2048	1235	Server	CCP certificate	Y	3650 days
11	K8S_MSG_CLIENT	NAPP/SSP	k8s-msg-client	RSA 2048	N/A	Client	Message Bus Client for K8S Platform Certificate Profile	N	825 days
12	COMPUTE_MANAGER	COMPUTE_MANAGER			N/A	Client	User will pass certificate while add/edit compute manager, NSX first imports the certificate using trust-management API POST /v1/trust-management/certificates?action=import and uses it in CM and then uses a reserve API to map that certificate for CM POST /v1/trust-management/certificates/<certId>?action=reserve When deleting the CM, we release certificate /v1/trust-management/certificates/<certId>?action=release and delete it v1/trust-management/certificates/<certId>	Y
13	TN	TN	N/A	RSA 2048	N/A	Client		N	825 days
14	WEB_PROXY	Web (Forward) Proxy	WEB_PROXY	certificate is provided by customer, we don't have control on this.	certificate is provided by customer, we don't have control on this.	Server	certificate that used for communicate between NSX - proxy and any outside server(i.e notification watcher)	Y	certificate is provided by customer.
15	NAPP_COMMON_AGENT	SSP	napp-common-agent	RSA 2048	N/A	Client	SSP client certificate for communicating with SSP common agent Only activated after onboarded to SSP	N	825 days
16	NAPP_PACE_AGENT	SSP	napp-intel-agent	RSA 2048	N/A	Client	SSP client certificate for communicating with SSP intelligence agent Only activated after onboarded to SSP	N	825 days
17	NAPP_METRICS_AGENT	SSP	napp-metrics-agent	RSA 2048	N/A	Client	SSP client certificate for communicating with SSP metrics agent Only activated after onboarded to SSP	N	825 days
18	LOGGING	RSYSLOG (For TLS logging server) LIAGENT (For LI-TLS logging server)	RSYSLOG(For TLS logging server): syslog-ca:<exporter_name> syslog-client-ca:<exporter_name> RSYSLOG_CLIENT LIAGENT (For LI-TLS logging server): Not stored in NSX trust management store	Keys and certificates are provided by customer, we don't have control on this.	Keys and certificates are provided by customer.	Client and Server	Client certificate and Server certificate for TLS communication between RSYSLOG/LIAGENT running in NSX and remote logging server.	N	Keys and certificates are provided by customers
19	NEST_DB							N

Deprecated NSX-T certificates as of NSX-T 4.2.0 G.A.

	Service Type(This is the name to use for all external documentation)	Application	Alias	AlgorithmKey-Size	Protocol	Port	Description	Expiry time	Notes
1	RABBITMQ	RabbitMQ		RSA 2048		5671	RabbitMQ public key	1825 days	No longer used.
2	CBM_API	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated in version 4.2
3	CBM_AR	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated in version 4.2
4	CBM_CCP	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated in version 4.2
5	CBM_CSM	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated version 4.2
6	CBM_GM	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated version 4.2
7	CBM_IDPS_REPORTING	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated version 4.2
8	CBM_MONITORING	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated version 4.2
9	CBM_MP	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated version 4.2
10	CBM_CM_INVENTORY	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated version 4.2
11	CBM_UPGRADE_COORDINATOR	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated version 4.2
12	CBM_SITE_MANAGER	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated version 4.2
13	CBM_MESSAGING_MANAGER	CBM	self	RSA 2048	TLS 1.2	client port	Corfu client certificate	100 years	Deprecated version 4.2
14	CSM	CSM	tomcat
15	ANALYTICS_AGENT		collector-agent	RSA 2048				N	Y
16	ANALYTICS_KAFKA		kafka	RSA 2048				N	Y

Reference Key:

APH = Appliance Proxy Hub

AR = Aysnchronous Replicator

CBM = Cluster Boot Manager

CCP = Control Config Plane

CSM = Cloud Service Manager

GM = Global Manager

MP = Management Plane (Proton)

TN = Transport Node

UA = Unified Appliance

VMC = VMware Cloud

NAPP = NSX Application Platform (aka: NSX Intelligence)

CSM = Cloud Service Manager

Additional Information

Please see the following references:

Certificates for NSX and NSX Federation

Replace Certificates Through API

Handling Log Bundles for offline review with Broadcom support