Certificate replacement script throws mismatch error for CBM_UPGRADE_COORDINATOR in corfu server truststore

Products

• VMware NSX

Issue/Introduction

• CBM certs have been replaced due to the following issue NSX alarms indicating certificates have expired or are expiring
  
  
• If you use CARR script, it reports errors like below in CARR Script Validation Report at the end.
  Example:

Error CBM_UPGRADE_COORDINATOR | SUCCESS: ##.##.###.#7                                         | Certificate with alias 7######1-##d9-4##5-####-c######d##7 |
|                             | SUCCESS: ##.##.##.##8                                         | of node ##.#####.##7 will be replaced with keystore         |
|                             | ERROR  : ##.##.###.##6   : CBM_UPGRADE_COORDINATOR's          | '##.##.###.##6' certificate                                 |
|                             | certificate in keystore of node ##.##.###.##6 does not match  |                                                             |
|                             | with corfu server truststore of node ##.##.###.##7            |

Environment

VMware NSX

Cause

This issue occurs because the CBM_UPGRADE_COORDINATOR certificate in the keystore of the local node  does not match the certificate registered in the corfu server truststore of its peer node.

Resolution

The CARR script can be used to resolve this issue. See Using Certificate Analyzer, Results and Recovery (CARR) Script to fix certificate related issues in NSX