Error: "Certificate validation failed for NSX-FQDN" when replacing NSX certificate via VCF Operations UI

Products

• VCF Operations

Issue/Introduction

• Replacing NSX certificate vis certificate manager on the VMware Cloud Foundation (VCF) Operations UI fails with the error below:
  
  Message: Certificate validation failed for NSX-FQDN with
error { "status" : "REJECTED? "error_message" : “Certificate was rejected:
KeyUsage does not allow key encipherment" }
Remediation Message:
Reference Token:


• You are trying to replace the NSX certificate with a custom CA-Signed certificate generated from the CSR generated from VCF Operations UI.

Environment

VMware Cloud Foundation 9.x

Cause

When replacing an expired or expiring certificate with a custom CA-signed certificate, the NSX Manager API validation explicitly rejects the payload if the KeyUsage extension does not allow key encipherment. The validation engine mandates this attribute to facilitate secure TLS handshakes.

Resolution

1. Discard the currently rejected certificate.
2. Generate a new Certificate Signing Request (CSR).
3. Instruct your Certificate Authority (CA) to sign the new certificate, ensuring that the **Key Encipherment** parameter is explicitly enabled under the `KeyUsage` extension (typically configured as `keyUsage = digitalSignature, keyEncipherment` in CA templates).
4. Re-attempt the certificate replacement workflow in the respective component UI or API using the newly minted, compliant certificate.

Additional Information

For additional information visit the documentation Managing Certificates in VMware Cloud Foundation
For additional information on NSX certificate visit the documentation Import a Self-signed or CA-signed Certificate for NSX