Replacing NSX Manager certificate via API fails with ""error_code": 36578, "error_message": "An error occurred setting the cluster certificate.","

Products

• VMware NSX

Issue/Introduction

• Replacing a NSX Manager certificate via API fails with the output: 
  
  {
      "error_code": 36578,
      "error_message": "An error occurred setting the cluster certificate.",
      "module_name": "node-services"
  }
• Certificate validation is successful
• /var/log/proton/catalina.log shows an error like:
  INFO org.apache.coyote.http11.Http11Processor service Error parsing HTTP request header
 Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
java.lang.IllegalArgumentException: Invalid character found in the request target [/nsxapi/api/v1/trust-management/certificates/<certID>?action=get_private ]. The valid characters are defined in RFC 7230 and RFC 3986
        at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:490)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:936)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1791)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
        at java.base/java.lang.Thread.run(Unknown Source)

Environment

VMware NSX

Cause

This occurs when the <> brackets are left enclosing the certificate ID in the API call.

Example (incorrect) API call:

POST https://<nsx-mgr>/api/v1/trust-management/certificates/<########-####-####-####-############>?action=apply_certificate&service_type=APH&node_id=<########-####-####-####-############>

Resolution

Ensure the <> brackets are not enclosing the certificate or node IDs of the API call.

Example correct call:

POST https://YourNSXManagerNameOrIP/api/v1/trust-management/certificates/########-####-####-####-############?action=apply_certificate&service_type=APH&node_id=########-####-####-####-############

Additional Information

Please see Replace Certificates Through API for more information on replacing NSX certificates using the API.