SDDC Manager NSX upgrade fails at NSX_T_PARALLEL_CLUSTER stage with "Certificate doesn't match any of the subject alternative names"

Products

• VMware NSX

Issue/Introduction

SDDC Manager upgrade fails during the NSX-T upgrade process at the NSX_T_PARALLEL_CLUSTER stage with a certificate Subject Alternative Name (SAN) validation error.

In the SDDC Manager UI, the upgrade fails with:

Upgrade element resourceType: NSX_T_PARALLEL_CLUSTER 
resourceId: <nsx-manager-fqdn>:_ParallelClusterUpgradeElement 
status changed to COMPLETED_WITH_FAILURE
```

In `/var/log/vmware/vcf/lcm/lcm-debug.log`, the following error is observed:
```
ERROR [vcf_lcm] NSX pre-upgrade checks failed

Certificate for <correct-vxrail-manager-fqdn> doesn't match any of the 
subject alternative names: [<incorrect-vxrail-manager-fqdn>, 
<incorrect-vxrail-manager-shortname>, <email-address>]

The error indicates that during the NSX upgrade precheck, SDDC Manager detected that the VxRail Manager certificate contains incorrect Subject Alternative Names (SANs) that do not match the actual VxRail Manager FQDN.

To search for this error in the SDDC Manager log bundle:

cd /var/log/vmware/vcf/lcm/
grep -i "doesn't match any of the subject alternative names" lcm-debug.log

Or to search for all recent failures:

grep -i "failure" lcm-debug.log

Environment

• VMware Cloud Foundation
• VMware SDDC Manager
• VMware NSX
• Dell VxRail Manager

Cause

The VxRail Manager certificate Subject Alternative Name (SAN) field does not match the actual VxRail Manager FQDN that SDDC Manager is attempting to validate during the NSX upgrade precheck.

This occurs when:

• A certificate was generated for a different VxRail Manager system and incorrectly applied to the current system
• The certificate was created with incorrect SAN entries during deployment or replacement
• VxRail Manager was renamed but the certificate was not updated accordingly

During the NSX upgrade, SDDC Manager's Lifecycle Manager (LCM) performs compatibility checks which include SSL/TLS validation of the VxRail Manager certificate. If the certificate's SAN does not match the expected hostname, the upgrade fails at the NSX_T_PARALLEL_CLUSTER stage.

Resolution

Work with Dell VxRail support to replace the VxRail Manager certificate using the correct Certificate Signing Request (CSR) that includes the proper Subject Alternative Names.

For more information on certificate replacement and validation, see Replacing SDDC manager certificates with custom certs failed with "Could not resolve the hostname"

After the VxRail Manager certificate has been replaced with the correct Subject Alternative Names, follow the steps in Broadcom KB 316938 to update the SDDC Manager trust store: "Update SDDC Manager when a VxRail Manager certificate has been replaced"

Once the trust store has been updated and SDDC Manager services have been restarted, retry the NSX upgrade from the SDDC Manager UI. The upgrade should now proceed past the NSX_T_PARALLEL_CLUSTER stage.