NSX Manager Trust Establishment Failure with Compute Manager (Error 90011)

Products

• VMware NSX

Issue/Introduction

When attempting to enable trust on a configured Compute Manager within the NSX Manager user interface, the operation fails. The system throws **Error Code 90011** along with an unexpected `ResourceAccessException`. This issue prevents the successful establishment of the federation token exchange between NSX Manager and the vCenter Server.

Environment

• NSX 4.x
• NSX 9.x
• VMware vCenter 8.x
• VCF 9.x

 

Cause

The root cause is a misaligned DNS name resolution and network routing/security configuration.

The vCenter Server identity provider mandates that all federation handshakes execute using its defined **Primary Network ID (PNID)** FQDN. However, the DNS servers or local routing definitions used by the NSX Manager cluster translate this FQDN (##########.#####.###) to an incorrect or blocked IP address (x.x.x.x) instead of the correct management IP path (y.y.y.y).

Because traffic routed to x.x.x.x on port 443 is silently dropped by intermediate firewalls or routing policies (indicated by the indefinite connection timeout without a TCP RST), the OpenID Connect metadata handshake cannot be completed. The target FQDN cannot be manually bypassed or substituted because the OpenID protocol dynamically redirects the handshake explicitly to the vCenter Server's literal PNID string.

Resolution

If vCenter is multihomed, please ensure DNS records resolve to vCenter servers PNID IP address.

1. Update the record definitions on your corporate authoritative DNS servers so that the forward lookup for the vCenter Server PNID FQDN resolves to the correct management IP address.
2. Flush NSX Manager DNS Cache
   1. Log into the command-line interface (CLI) of **each** NSX Manager cluster node via SSH using administrative credentials and run the following command to drop stale mapping tables immediately:
      clear dns-cache
3. Re-enable Trust in NSX Manager UI
   1. Navigate to the NSX Manager UI.
   2. Open the Edit Compute Manager registration menu for the affected vCenter.
   3. Ensure the Enable Trust toggle remains set to "Yes".
   4. Click Save to commit and complete the federation token exchange.