NSX Manager upgrade fails with certificate expiry less than 825 days error in SDDC Manager

Products

• VMware NSX
• VMware SDDC Manager / VCF Installer

Issue/Introduction

• Upgrading NSX from 4.2.3.3 to 4.2.4 
• Pre-check for NSX Upgrade might failed on SDDC Manager
• Below error will be seen on SDDC Manager

Upgrade - NSX_T_MANAGER <NSX_MANAGER_FQDN> Failed <Timestamp>

 

Description	Upgrade - NSX_T_MANAGER <NSX_MANAGER_FQDN>
Progress Messages	Execute CARR Script to check certificate issues: [Invalid or self-signed certificates with expiry less than 825 days detected. Please click Resolve to replace expiring and expired certificates to proceed with the upgrade.]: <Target_NSX_Manager_Components>
Error	Message: Execute CARR Script to check certificate issues: [Invalid or self-signed certificates with expiry less than 825 days detected. Please click Resolve to replace expiring and expired certificates to proceed with the upgrade.]: <Target_NSX_Manager_Components> Remediation Message: NSX upgrade failed in precheck for manager cluster. Check for errors in the LCM log files at 127.0.0.1:/var/log/vmware/vcf/lcm, and address those errors. Please run the upgrade precheck and restart the upgrade. Reference Token: ###### Cause:

• No expired or short-lived certificates are visible in the NSX Manager UI under System > Certificates.
• CARR script dry run reports warnings for both self-signed and CA-signed certificates.

Environment

VMware NSX

VMware SDDC Manager

Cause

• The precheck calls the CARR script which that validates all internal service certificates.
• Certain internal certificates, such as the LOCAL-MANAGER-PI or CBM-Corfu certificates, may have been issued with a validity period of 825 days in previous versions.
• These certificates are not always visible in the standard NSX Manager UI but will block the upgrade if they are within the 825-day expiry window.

Resolution

• Identify and replace the non-compliant self-signed certificates. Note that the upgrade precheck specifically blocks on self-signed certificates, and not CA-signed certificates.
• CA-signed certificates reported by CARR can typically be managed after the upgrade unless they are already expired.
• Execute CARR Script to check and resolve these certificate issues. See Using Certificate Analyzer Resolver (CARR) Script to fix certificate related issues in NSX:
  1. Take a backup of the NSX Manager and SDDC Manager.
  2. Upload the Certificate Analyzer Resolver (CARR) script to any of the NSX Managers in the cluster.
  3. Execute the CARR script in dry-run mode to identify which specific self-signed certificate is triggering the 825-day policy:
     - ./start.sh -d
  4. Review the output for any self-signed certificates (e.g., LOCAL-MANAGER-PI) marked as failing the 825-day check.
  5. If the certificate is visible in the UI, navigate to System > Certificates, select the certificate, and use the Actions menu to make the replacement.
  6. If the certificate is not visible or is an internal service cert, run the CARR script in remediation mode to replace it.
  7. Rerun the Upgrade Precheck in SDDC Manager to proceed.
  8. For issues involving CA-signed certificates that require manual replacement, see KB 414001.

Additional Information

Alarms Indicating CBM Certificates Have Expired or Are Expiring Prevent NSX Manager Upgrades