Host and Edge transport nodes show as being Disconnected and MPA Connectivity Down after APH certificate expires on the NSX managers

Products

• VMware NSX

Issue/Introduction

ESXi hosts and Edge transport nodes show as "Disconnected" or "MPA Connectivity Down" in the NSX Manager UI. This condition prevents VM provisioning and network management. Appliance Proxy Hub (APH) certificates on the NSX Manager cluster have expired.

• The ESXi host shows disconnected in the NSX UI, as seen in the following screenshot:
  

• Also, you might see the edges showing as MPA connectivity down
  

• Transport node going offline.
• Certificates expired in NSX. APH-AR, APH-TN, API and cluster certificate.

Environment

VMware NSX 

Cause

NSX manager APH certificates expired, which are used for communication between the NSX managers and the transport notes and edges 

 

Resolution

Run the CARR script to fix the certificate on the NSX manager:

Using Certificate Analyzer, Results and Recovery (CARR) Script to fix certificate related issues in NSX

If the host still shows as disconnected after renewing the certificates on the NSX manager, then follow the next steps:

1. Get a putty session to an NSX manager as  admin and run the following command:
•  get certificate api thumbprint
2. After we have the thumbprint of a manager, open a putty session to the ESXI that is being impacted and run the following commands 
• nsxcli
3. Once there we are going to have to gather information for the next commands 
• Manager FQDN
• Manager api thumbprint  ( this is gather on the step above with get certificate)
• User ( this should be admin)
• Password 
4. Command that will be need to be run on the impacted hosts
• push host-certificate <manager-IP-FQDN> username <username> thumbprint <cert-api-thumbprint-of-manager> password <password>
• sync-aph-certificates <manager-IP-FQDN> username <username> thumbprint <cert-api-thumbprint-of-manager> password <password>
5. Once  both commands are run, type exit to get out of nsxcli and then run the following commands:
• /etc/init.d/nsx-proxy restart
• /etc/init.d/nsx-opsagent restart
6. You may need to click Resolve in the NSX UI under the Transport Nodes status to clear the error after these steps.

 

For the Edge

Run the following commands. 

1. Get a putty session to an NSX manager as  admin and run the following command:
   •  get certificate api thumbprint
2. After we have the thumbprint of a manager, open a putty session to the edge and log in as admin
3. Once there we are going to have to gather information for the next commands 
   • Manager FQDN
   • Manager api thumbprint  ( this is gather on the step above with get certificate)
   • User ( this should be admin)
   • Password 
4. Command that will be need to be run on the impacted edges 
   • push host-certificate <manager-IP-FQDN> username <username> thumbprint <cert-api-thumbprint-of-manager> password <password>
   • sync-aph-certificates <manager-IP-FQDN> username <username> thumbprint <cert-api-thumbprint-of-manager> password <password>
5. Once  both commands are ran, type st en to get into root and then run the following commands
   • /etc/init.d/nsx-proxy restart
   • /etc/init.d/nsx-opsagent-appliance restart

For this component give it a couple minutes, and you should be able to see them come back and green

Additional Information

Verify Appliance Proxy Hub on all NSX Manager Nodes are Connected