Transport Node certificates expiring within 825 days warning during NSX Manager upgrade pre-check

Products

• VMware NSX

Issue/Introduction

• While performing an upgrade pre-check in NSX Manager, a warning is flagged under the Component Level Issues tab.
• Although you can acknowledge a warning and continue the upgrade, it is strongly advised to remediate this pre-check condition beforehand to ensure your environment remains stable. If the certificates expire post-upgrade, an active environment alarm triggers, and you must replace the certificates manually on a per-host basis.  
• No expired or expiring certs are seen in the GUI , TN certs are not shown here as they are host side.
• The certificate can be checked manually on an ESXI by running:

openssl x509 -in /etc/vmware/nsx/host-cert.pem -noout -dates

• The following full warning text appears in the user interface:

Transport Node certificates expiring within 825 days have been detected. It is strongly recommended to run the CARR script before upgrading NSX Manager to replace these certificates proactively. For detailed instructions, refer to KB article https://knowledge.broadcom.com/external/article?articleId=369034.

Environment

VMware NSX

Cause

The warning occurs because the certificate lifespan for Transport Nodes (TN) was mistakenly configured to 824 days in versions 4.1.x and 4.2.0. The default duration is 10 years. While this configuration is corrected in subsequent releases, the upgrade pre-check proactively flags existing affected certificates so you can replace them in a non-disruptive manner before expiration.

Resolution

This is only a pre-check warning and can be acknowledged / skipped but it is strongly recommended the certificates be replaced prior to upgrade.

You can replace the certificates centrally from the NSX managers using the automated CARR script  Using Certificate Analyzer, Results and Recovery (CARR) Script to fix certificate related issues in NSX.

Alternatively the certificates can be replaced in a manual fashion by following the workaround steps in KB Alarm For Transport Node Certificate is About to Expire.