NSX Load Balancer SSL Certificate Import Fails with "Error code: 502173"

Products

• VMware NSX

Issue/Introduction

• When configuring an SSL offload on a Load Balancer (LB) in NSX Manager, saving the configuration fails after importing the server certificate, intermediate certificate, and private key.
• The following error is displayed in the UI:

"Error: Certificate does not comply with OpenSSL 3.0. (Error code: 502173)"

Environment

VMware NSX

Cause

This issue is caused by an improperly formatted and incomplete certificate chain.

Formatting: There are missing line breaks between the certificates (e.g., -----END CERTIFICATE----------BEGIN CERTIFICATE-----), which prevents the system from recognizing the start of the next certificate.

Resolution

To resolve this issue, you must include the whole certificate chain in the correct order (Server -> Intermediate -> Root) and ensure proper PEM formatting.

1. Download the required Root Certificate in PEM format from your Certificate Authority (CA).
2. Open your certificate file in a plain text editor.
3. Format the certificate contents to include the Server Certificate, Intermediate Certificate, and Root Certificate in that exact order. Ensure there is a new line between the end of one certificate and the beginning of the next.

   • Correct Format Example:

     -----BEGIN CERTIFICATE-----
     <Server Certificate Data>
     -----END CERTIFICATE-----
     -----BEGIN CERTIFICATE-----
     <Intermediate Certificate Data>
     -----END CERTIFICATE-----
     -----BEGIN CERTIFICATE-----
     <Root Certificate Data>
     -----END CERTIFICATE-----

4. Log in to the NSX GUI.
5. Navigate to System > Certificates.
6. Select Import > Certificate.
7. Enter a name for the certificate configuration.
8. Paste the correctly formatted certificate chain from Step 3 into the Certificate Contents field.
9. In the Private Key field, select Browse and choose the corresponding private key file.
10. Click Save.