NSX LDAPS server connection fails with "An error occurred while establishing a secure connection with LDAP"

Products

• VMware NSX

Issue/Introduction

• When configuring or maintaining Identity Providers, the connection to LDAPS servers fails and the servers show a disconnected/failed status in the NSX UI (User Management > Identity Providers).

• The following error appears in the UI:
  "An error occurrred while establishing a secure connection with LDAP. check that ldap server's certificate is correct and that it is using an SSL/TLS cipher suite that is compatible with NSX manager"

• Basic network connectivity was verified as operational; ping and netcat commands over required port demonstrated successful communication between the NSX manager and the LDAPS servers.

• NSX manager logs (/var/log/proton/nsxapi.log) record a CRL exception similar to the following:
  
  Caused by: java.security.cert.CRLException: Couldn't find signing principal of the CRL CN=<CA-server-name>
        at com.vmware.nsx.management.security.CdpCrlChecker.checkRevocation(CdpCrlChecker.java:131) ~[nsx-trustmanager-1.0.jar:?]
        at com.vmware.nsx.management.security.CdpCrlChecker.checkRevocation(CdpCrlChecker.java:79) ~[nsx-trustmanager-1.0.jar:?]
        at com.vmware.nsx.management.security.NsxTrustManager.checkCertificateValid(NsxTrustManager.java:371) ~[nsx-trustmanager-1.0.jar:?]
        at com.vmware.nsx.management.security.NsxTrustManager._checkServerTrusted(NsxTrustManager.java:330) ~[nsx-trustmanager-1.0.jar:?]

   
• It is also validated that you are using only self signed certificates for NSX

Environment

VMware NSX

Cause

• This issue occurs because the Certificate Revocation List (CRL) check is enabled and fails to validate the self-signed certificate.
• By default, the CRL check is disabled in fresh installations of NSX-T 3.0.2 and 3.1.0+. However, environments upgraded from older versions retain their legacy configuration, keeping the CRL check enabled and resulting in connection blocks for self-signed certificates.

Resolution

CRL check has been disabled by default in NSX-T Data Center 3.0.2 and 3.1.0 and above.
Note that environments deployed on an earlier release and upgraded will continue to have CRL check enabled unless disabled manually.

Follow the below KB for resolution/workaround:
Failure to apply NSX-T certificate: Couldn't get LDAP context from URI

If the issue persists even after disabling the CRL check following the above KB, please open a case with Broadcom Support Team.