NSX Upgrade - Fails to load Upgrade pre-check file (PUB) due to repo-sync failure

Products

• VMware NSX

Issue/Introduction

• You upload the PUB/MUB file and it does not sync to the other NSX managers
• You have verified the PUB/MUB file is located in /repository/ on the NSX Manager Upgrade Coordinator
• You see the following error in the UI

[##.##.##.##] Unable to connect to File /repository/4.2.3.0.0.24866349/UC/jre/upgrade-coordinator-tomcat-wrapper on source ##.##.##.##. Please verify that file exists on source and install-upgrade service is up..

• On the Upgrade Coordinator logs in /var/log/upgrade-coordinator/latest.log you may see the following error:

025-10-30T16:20:51.965Z  INFO NSXUcUpgradeService-1-1 LoggingRestTemplate 1691643 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="upgrade-coordinator"] response: Response:: status code:200 OK status: body:123
  "status" : "FAILED",
  "status_message" : "",
  "failure_message" : "Unable to connect to File /repository/4.2.3.0.0.24866349/UC/jre/upgrade-coordinator-tomcat-wrapper on source ##.##.##.##. Please verify that file exists on source and install-upgrade service is up.",
  "failure_code" : 21057
}

• On the nodes that are NOT the upgrade coordinator you may see the following in /var/log/upgrade-coordinator/latest.log

2025-10-30T16:20:47.004Z  INFO RepoSyncThread-1761840906690 RepoSyncFileHelper 4876 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="manager"] Command to check if remote file exists for https://##.##.##.##:443/repository/4.2.3.0.0.24866349/UC/jre/upgrade-coordinator-tomcat-wrapper returned result CommandResultImpl [commandName=null, pid=4016856, status=FAILED, errorCode=60, errorMessage=curl_wrapper: (60) certificate has expired
, commandOutput=null]
2025-10-30T16:20:47.004Z ERROR RepoSyncThread-1761840906690 RepoSyncServiceImpl 4876 SYSTEM [nsx@6876 comp="nsx-manager" errorCode="MP21057" level="ERROR" subcomp="manager"] Unable to start repository sync operation.See logs for more details.
com.vmware.nsx.management.appliance.repository.exception.RepoSyncException: Unable to connect to File /repository/4.2.3.0.0.24866349/UC/jre/upgrade-coordinator-tomcat-wrapper on source ##.##.##.##. Please verify that file exists on source and install-upgrade service is up.

Environment

VMware NSX

Cause

The upgrade coordinator has Expired API Certificates.

Resolution

If the expired API certificates are self-signed then use CARR to replace them, then upload PUB/MUB file.

If the expired API certificates is provided by a Custom CA, refer to  How to Replace NSX Manager Certificates Using CA-Signed Certificates in NSX 4.x

 

Additional Information

To determine the upgrade coordinator see Upgrade the Upgrade Coordinator

To replace expired certificates refer to Using Certificate Analyzer, Results and Recovery (CARR) Script to fix certificate related issues in NSX

To replace expired API certificates provided by a Custom CA refer to How to Replace NSX Manager Certificates Using CA-Signed Certificates in NSX 4.x