Remediate NSX Compute Manager Connection After vCenter PNID update
search cancel

Remediate NSX Compute Manager Connection After vCenter PNID update

book

Article ID: 443455

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

After updating the Primary Network Identifier (PNID) or Security Token Service (STS) certificates on a vCenter Server Appliance, the connection to the associated NSX Compute Manager status shows as down or disconnected.

Symptoms:

  • In the NSX Manager UI, navigating to System > Fabric > Compute Managers displays the target vCenter Server with DOWN status.

  • Communication between NSX and the vCenter Server is broken. This can be also verified from /var/log/cm-inventory/cm-inventory.log

    <Timestamp> ERROR EamPollingThread AgencyMonitoringService 4923 FABRIC [nsx@6876 comp="nsx-manager" errorCode="MP26153" level="ERROR" subcomp="manager"] [HostPinned]: Failed to get EAM status for compute manager ComputeManagerModeLMsg/<UUID_of_Compute_Manager> com. vmware.nsx.management. lcm. vc.soap. exceptions.HostBasedVMException: Error connecting EAM on compute manager<UUID_of_Compute_Manager>. Error javax.net.ssl. SSLHandshakeException: d7120875c679123a2860e56f6455f67d1e844e81cedd6ed737831b294a3c0f33

  • Log entries in the NSX manager backend indicate authentication failures or untrusted certificate chains when attempting to establish a connection with the vCenter Lookup Service.

Environment

VMware NSX

VMware vCenter Server

Cause

This problem occurs because the thumbprint of the certificate that NSX Manager holds is different from the updated thumbprint.The thumbprint of the certificate will change only when the certificate itself is replaced. This may be from  following the replacement of the vCenter Server certificate using vCert - expired certificate replacement script

Resolution

Follow the resolution steps below to synchronize the updated configurations:

  1. Log in to the NSX Manager user interface with administrative privileges.

  2. Navigate to System > Fabric > Compute Managers.

  3. Select the affected vCenter Server Compute Manager entry and click Edit.

  4. Review the registration parameters. A prompt will display highlighting that the certificate has changed.

  5. Review and accept the new certificate thumbprint to re-establish the trust anchor.

  6. Provide the appropriate vCenter Server administrative credentials when prompted to force an explicit directory remediation and re-register the connection.

  7. Click Save and verify the status changes back to Up/Connected.

Additional Information

After the vCenter Server certificate is replaced, the compute manager connection is "Down" in the NSX UI

Powered by Wolken Software