Unable to uninstall NSX VIBs from ESXi host using 'del nsx' due to untrusted self-signed certificate on legacy nsx-python-protobuf VIB

Products

• VMware NSX

Issue/Introduction

• Uninstallation of VMware NSX from an ESXi host fails via the NSX Manager UI and the local del nsx CLI command.

• The nsxcli -c del nsx command appears to run successfully, but esxcli software vib list confirms the NSX VIBs remain actively installed on the host.

• In the /var/run/log/esxupdate.log on the affected ESXi host, you see errors similar to the following indicating a secure abort:
  

  Verifying VIB VMware_bootbank_nsx-python-protobuf_2.6.1-19195979 signature #1
  
  Failed to verify VIB signature #2: ('VMware_bootbank_nsx-python-protobuf_2.6.1-19195979', 'Could not find a trusted signer: self-signed certificate'

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX

Cause

During the uninstallation of NSX components, the ESXi esxupdate daemon evaluates the host's active Image Profile and enforces strict cryptographic validation of all installed VIBs. If an older nsx-python-protobuf VIB containing an untrusted self-signed certificate is present, the daemon securely aborts the transaction to protect the bootbank.

Resolution

This is a condition that may occur in a VMware NSX environment.

 

Workaround

Manually bypass the cryptographic signature check to remove the stale VIB, clear the orphaned dependency, and uninstall the NSX components via the ESXi OS directly.

1. Open an SSH session to the affected ESXi host and log in as root.

2. Forcefully remove the legacy protobuf VIB by bypassing the signature check: esxcli software vib remove -n nsx-python-protobuf --no-sig-check

3. Reboot the ESXi host to clear the in-memory state.

4. Repeat the uninstall attempt and the VIBs should be removed.