Upgrading VCF to 9.1 failed on NSX planning phase precheck
search cancel

Upgrading VCF to 9.1 failed on NSX planning phase precheck

book

Article ID: 440910

calendar_today

Updated On:

Products

VMware SDDC Manager / VCF Installer

Issue/Introduction

  • When performing an upgrade to VMware Cloud Foundation (VCF) 9.1, the SDDC Manager precheck fails during the NSX planning phase with a High impact status:
    Description: NSX planning phase precheck
    Result: Resource validations timed out
    Remediation: Please contact Broadcom Technical Support for further assistance.

  • The lcm-debug.log records the following exception:
    YY-MM-DDThh:mm:ss:xx:xx:xxx WARN  [vcf_lcm,6a0476d7cce27adb8a645c0075165811,8746,auditId=d015d590-54a2-476c-92e5-2360ad9b2e8b,resourceType=NSX_T_MANAGER,resourceId=<REDACTED_HOSTNAME>,name=<REDACTED_HOSTNAME>] [c.v.e.s.l.p.impl.nsxt.NsxtAuditImpl,Scheduled-4] Error auditing NSX Cluster <REDACTED_HOSTNAME>
    with exception Failed to load NSX Cluster from the Inventory
    YY-MM-DDThh:mm:ss:xx:xx:xxx  ERROR [vcf_lcm,6a0476d7cce27adb8a645c0075165811,8746,auditId=d015d590-54a2-476c-92e5-2360ad9b2e8b,resourceType=NSX_T_MANAGER,resourceId=<REDACTED_HOSTNAME>,name=<REDACTED_HOSTNAME>] [c.v.e.s.l.p.i.nsxt.NsxtUpgradeUtil,Scheduled-4] Handling NSX Exception
    com.vmware.evo.sddc.lcm.model.error.LcmException: Failed to load NSX Cluster from the Inventory
            at com.vmware.evo.sddc.lcm.primitive.impl.nsxt.NsxtInventoryLoader.loadNsxtInventory(NsxtInventoryLoader.java:114)
            at com.vmware.evo.sddc.lcm.primitive.impl.nsxt.NsxtAuditImpl.doAudit(NsxtAuditImpl.java:111)
            at com.vmware.evo.sddc.lcm.audit.NsxtAuditService.performAudit(NsxtAuditService.java:119)
            at com.vmware.evo.sddc.lcm.audit.NsxtAuditService.doAudit(NsxtAuditService.java:153)
            at com.vmware.evo.sddc.lcm.audit.NsxtInventoryAuditScheduler.auditNsxtInventoryTask(NsxtInventoryAuditScheduler.java:158)
            at com.vmware.evo.sddc.lcm.audit.NsxtInventoryAuditScheduler.processTask(NsxtInventoryAuditScheduler.java:176)
            at com.vmware.evo.sddc.lcm.model.task.AbstractLcmControllableScheduledTask.recieveMessage(AbstractLcmControllableScheduledTask.java:56)
            at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
            at java.base/java.lang.reflect.Method.invoke(Method.java:580)
            at com.google.common.eventbus.Subscriber.invokeSubscriberMethod(Subscriber.java:85)
            at com.google.common.eventbus.Subscriber$SynchronizedSubscriber.invokeSubscriberMethod(Subscriber.java:142)
            at com.google.common.eventbus.Subscriber.lambda$dispatchEvent$0(Subscriber.java:71)
            at com.google.common.util.concurrent.DirectExecutor.execute(DirectExecutor.java:31)
            at com.google.common.eventbus.Subscriber.dispatchEvent(Subscriber.java:68)
            at com.google.common.eventbus.Dispatcher$PerThreadQueuedDispatcher.dispatch(Dispatcher.java:111)
            at com.google.common.eventbus.EventBus.post(EventBus.java:270)
            at com.vmware.evo.sddc.lcm.audit.NsxtInventoryAuditScheduler.auditNsxtInventory(NsxtInventoryAuditScheduler.java:75)
            at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
            at java.base/java.lang.reflect.Method.invoke(Method.java:580)
            at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:360)
            at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196)
            at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
    Caused by: com.vmware.vapi.client.exception.SslException: Certificate for <REDACTED_HOSTNAME> doesn't match any of the subject alternative names: [<REDACTED_HOSTNAME>, <REDACTED_HOSTNAME>, <REDACTED_HOSTNAME>, <REDACTED_HOSTNAME>, <REDACTED_IP>, <REDACTED_IP>, <REDACTED_IP>, <REDACTED_IP>]
            at com.vmware.vapi.internal.protocol.client.rpc.http.ApacheClientRestTransport.execute(ApacheClientRestTransport.java:107)

Environment

VMware Cloud Foundation 9.x

Cause

The SSL certificate installed on the NSX Manager Management Cluster Virtual IP (VIP) endpoint contains an incomplete Subject Alternative Name (SAN) list (e.g., listing only short names or incorrect domain entries). When SDDC Manager attempts to validate the Fully Qualified Domain Name (FQDN) of the NSX Manager cluster, the hostname verification fails with an SslException due to the missing SAN entry, halting the precheck process.




Resolution

  1. Update or replace the SSL certificate configured on the NSX Manager Management Cluster Virtual IP (VIP) endpoint to include all required Fully Qualified Domain Names (FQDNs) and IP addresses in its Subject Alternative Name (SAN) field as detailed in Broadcom KB 419814.

  2. Re-run the upgrade precheck in SDDC Manager

 

Additional Information

Existing components validation failed due to errors: Cannot connect to nsxmanager.example.com. Cause: Certificate for <nsxmanager.example.com> doesn't match any of the subject alternative names: [nsxmanagershortname]

Powered by Wolken Software