Certificate signing request generation fails to include Subject Alternative Name fields in NSX

Products

• VMware NSX

Issue/Introduction

In versions of VMware NSX prior to 4.2.1.0, the graphical user interface for managing trust certificates does not expose fields for entering Subject Alternative Name (SAN) attributes during the Certificate Signing Request (CSR) generation process. This prevents users from creating valid requests that include required FQDN or IP address extensions through the standard UI workflow, necessitating a programmatic approach to ensure certificate compliance with security standards.

Symptoms:

• You are unable to find or populate SAN fields in the NSX Manager UI during CSR generation.
• Signed certificates fail to import or validate because the required FQDN or IP attributes are missing from the request.

Environment

• VMware NSX versions prior to 4.2.1.0

Cause

The NSX Manager UI design in these releases does not include extended attribute support for SAN entries within the standard "Generate CSR" certificate request workflow.

Resolution

Fixed in release 4.2.1.0 and higher. See Download Broadcom products and software for steps to download this release.

To generate a CSR with Subject Alternative Name fields, you must utilize the NSX API. Follow these steps:

1. Log in to the NSX Manager CLI as the root user.
2. Create a JSON payload file named csr_payload.json on the local filesystem to define the certificate attributes:
   

   {
     "display_name": "####",
     "subject": {
       "attributes": [
         { "key": "CN", "value": "####" },
         { "key": "OU", "value": "####" },
         { "key": "O", "value": "####" },
         { "key": "L", "value": "####" },
         { "key": "ST", "value": "####" },
         { "key": "C", "value": "####" }
       ]
     },
     "key_size": "2048",
     "algorithm": "RSA",
     "extensions": {
       "subject_alt_names": {
         "dns_names": [
           "####",
           "####"
         ]
       }
     }
   }

3. Execute the following cURL command to submit the request to the extended CSR endpoint. Use the @ operator to ingest the JSON file: curl -k -X POST -H "Content-Type: application/json" -u "####:####" -d @csr_payload.json https://####/api/v1/trust-management/csrs-extended
4. If the administrator password contains special characters such as !, ensure they are properly escaped for the shell or update the password to a supported string before running the command.
5. Navigate to System > Certificates > CSRs in the NSX UI to view and download the newly created CSR.

Additional Information

For general certificate replacement procedures, refer to doc: Replace Certificates.