Cannot update the Principal Identity certificate in NSX

Products

• VMware NSX

Issue/Introduction

• Principal Identity (PI) certificate replacement throws an error. 

Error: Cannot update the principal identity certificate when it has a private key. Try replacing the certificate at its origin. (Error code: 2605)


Environment

VMware NSX

Cause

The purpose of a PI, is that the external entity making the API call, has the private key, to authenticate the certificate presented by the NSX PI user.

The certificate used by the NSX PI user (no key), was the certificate exported by the external entity (will have certificate and private key). 

Generating a CSR or self signed certificate in NSX, will not work, as in both cases, NSX retains the private key.

Resolution

Generate a CA signed certificate, external to NSX, the external entity making the API calls to NSX should have the certificate and private key.

You can follow step on this KB to import a certificate and replace the PI certificate with it How to replace a Principal Identity Certificate in NSX