"Invalid Bundle Name" or "Failed to fetch upgrade bundle from url" seen when attempting to load PUB/MUB file to NSX with "Download from Remote URL" option

Products

• VMware NSX

Issue/Introduction

• Using the "Download from Remote URL" fails with "Invalid Bundle Name" or "Failed to fetch upgrade bundle from url" error. 
• The remote host is using self-signed certificates
• You may see similar log entries in the NSX Manager log file /var/log/syslog 

 

2026-02-10T09:47:21.294Z ######.#####.### - - - - [NSX] [nsx@6876 comp="nsx-manager" subcomp="upgrade-coordinator"] uc_helper: spider cmd rc is 5, output is b'', error is b"Spider mode enabled. Check if remote file exists.\n--2026-02-10 09:47:21--  https://###.###.###.###/data/VMware-NSX-upgrade-bundle-4.2.3.1.0.24954727-pre-check.pub\nConnecting to ###.###.###.###:443... connected.\nERROR: cannot verify ###.###.###.###'s certificate, issued by \xe2\x80\x98emailAddress=####@#####.###,CN=#####,OU=###############,O=##########,C=US\xe2\x80\x99:\n  Self-signed certificate encountered.\n    ERROR: certificate common name \xe2\x80\x98##########\xe2\x80\x99 doesn't match requested host name \xe2\x80\x98###.###.###.###\xe2\x80\x99.\nTo connect to ###.###.###.### insecurely, use `--no-check-certificate'.\n"

2026-02-10T09:47:21.479Z ######.#####.### NSX 107466 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="upgrade-coordinator"] Caught error in facade interceptor

2026-02-10T09:47:21.479Z ######.#####.### NSX 107466 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="upgrade-coordinator"] Validate Upgrade Bundle URL https://###.###.###.###/data/VMware-NSX-upgrade-bundle-4.2.3.1.0.24954727-pre-check.pub with temp directory /image/upgrade-coordinator-tomcat/temp Command Result LocalSystemCommandResult{command=LocalSystemCommand{commandAndArguments=[nice, -n, 10, sudo, /opt/vmware/upgrade-coordinator-tomcat/bin/uc_helper.py, validate_mub_url, --mub-url, https://###.###.###.###/data/VMware-NSX-upgrade-bundle-4.2.3.1.0.24954727-pre-check.pub, --mub-temp-dir, /image/upgrade-coordinator-tomcat/temp, --use-proxy, false], executionDirectory='null', redirectErrorStream=false}, process=null, exitCode=100, commandStatus=FAILED, outputMessage='', errorMessage='/opt/vmware/upgrade-coordinator-tomcat/bin/uc_helper.py:24: DeprecationWarning: The distutils package is deprecated and slated for removal in Python 3.12. Use setuptools or check PEP 632 for potential alternatives#012  from distutils import dir_util#012', processId=2674170}

2026-02-10T09:47:21.479Z ######.#####.### NSX 107466 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="upgrade-coordinator"] Failed to validate Upgrade Bundle URL https://###.###.###.###/data/VMware-NSX-upgrade-bundle-4.2.3.1.0.24954727-pre-check.pub with temp directory /image/upgrade-coordinator-tomcat/temp

 

Environment

VMware NSX

Cause

NSX does not support self-signed certificates on local repositories for upgrade bundles or prechecks at this time. 

Resolution

This is a condition that may occur in a VMware NSX environment.

 

Workaround: 

Note this workaround will disable the certificate check of the remote host reducing security on this feature. 

On each of the NSX manager nodes, the following command can be run as root user to disable certificate checking 

touch /opt/vmware/disable_url_check_certificate

To revert the configuration, remove the file 

rm /opt/vmware/disable_url_check_certificate