NSX Manager upgrade fails with certificate expiry less than 825 days error in SDDC Manager

Products

• VMware NSX
• VMware SDDC Manager / VCF Installer

Issue/Introduction

• Upgrading NSX from 4.2.3.3 to 4.2.4 
• Pre-check for NSX Upgrade might failed on SDDC Manager
• Below error will be seen on SDDC Manager

Upgrade - NSX_T_MANAGER <NSX_MANAGER_FQDN> Failed <Timestamp>

 

Description	Upgrade - NSX_T_MANAGER <NSX_MANAGER_FQDN>
Progress Messages	Execute CARR Script to check certificate issues: [Invalid or self-signed certificates with expiry less than 825 days detected. Please click Resolve to replace expiring and expired certificates to proceed with the upgrade.]: <Target_NSX_Manager_Components>
Error	Message: Execute CARR Script to check certificate issues: [Invalid or self-signed certificates with expiry less than 825 days detected. Please click Resolve to replace expiring and expired certificates to proceed with the upgrade.]: <Target_NSX_Manager_Components> Remediation Message: NSX upgrade failed in precheck for manager cluster. Check for errors in the LCM log files at 127.0.0.1:/var/log/vmware/vcf/lcm, and address those errors. Please run the upgrade precheck and restart the upgrade. Reference Token: ###### Cause:

 

Environment

VMware NSX

VMware SDDC Manager

Cause

Internal certificate with expiry less than 825 days detected which eventually blocks the upgrade.

 

Resolution

Execute CARR Script to check and resolve these certificate issues. See Using Certificate Analyzer Resolver (CARR) Script to fix certificate related issues in NSX.

 

Additional Information

Alarms Indicating CBM Certificates Have Expired or Are Expiring Prevent NSX Manager Upgrades