Unable to replace Load Balancer certificate in NSX UI
Article ID: 442351
Updated On:
Products
Issue/Introduction
When you attempt to renew or update an SSL certificate for a configured Load Balancer in NSX 4.2 or higher, you receive an error indicating the certificate is not compliant.
"Error : Certificate /infra/certificates/certifcate_name not complaint with OpenSSL 3.0 ( Error code 502173) "
Environment
VMware NSX 4.2.x
Cause
The issue is caused by a mismatch in the Common Name (CN) or an invalid trust chain within the presented certificate files i.e. Root , intermediate and server certificates.
Resolution
You must validate and correct the certificate chain before attempting to update the Load Balancer.
1. Log in to the NSX Manager CLI.
2. Navigate to the directory where your certificate files are located (e.g., `/tmp`).
3. Run the following commands to inspect the details of each certificate in your chain:
`openssl x509 -in ####.pem -noout -text`
`openssl x509 -in ####.pem -noout -text`
4. Verify that the **Issuer** of the server certificate matches the **Subject** of the intermediate certificate, and the **Issuer** of the intermediate matches the **Subject** of the root.
Below is sample snippet from Intermediate certificate. It must be validated that Issuer of intermediate certificate matches Subject of Root certificate.
5. If a mismatch is identified, contact your concerned certificate authority or security team to issue a corrected, valid certificate chain.
6. Once the chain is validated, re-import the certificates into NSX Manager and assign them to the Load Balancer profile.
Additional Information
Feedback
