CARR script does not replace CA signed certificate.

Products

• VMware NSX

Issue/Introduction

• In an NSX Manager environment, a system alarm may have triggered indicating that certificates are due to expire.
• Standard search results guide you to replace certificates using CARR script (Using Certificate Analyzer, Results and Recovery (CARR) Script to fix certificate related issues in NSX) .
• Attempting to renew or replace these certificates using the CARR script fails to update or affect the active  certificates on the manager nodes.
• CARR does not replace certificate, stating it is a CA signed certificate.
• The certificates are not self-signed and were previously Certificate Authority (CA) signed (by external CA or VMCA via Scripted process to replace expired or self-signed VMware NSX Manager Certificates with VMCA-Signed Certificates)

 

Environment

VMware NSX

Cause

The CARR (Certificate Analyzer, Results and Recovery) script is designed to resolve issues with self-signed certificates. It does not interact with CA-signed certificates to prevent breaking existing security compliance or external trust chains.

Resolution

If your deployment does not mandate a fully trusted external CA, you can resolve the expiration alarm by either generating new CA signed certificates externally and following the documented steps to replace the expiring certificate with these new certificates Admin Guide - Replace Certificates via GUI or Admin Guide - Replace certificates via API

Alternatively the API and VIP certificates can be replaced by the VCSA scripted approach Scripted process to replace expired or self-signed VMware NSX Manager Certificates with VMCA-Signed Certificates . This will be a VCSA signed certificate.

If a CA signed cert is not required, the existing expiring CA signed cert can be replaced with a self signed cert via the GUI. Follow these steps to do so :

• Log in to the NSX Manager GUI.
• Navigate to the certificate management options as outlined in the documentation: Replace Certificates Through NSX Manager.
• Generate a new self-signed manager certificate to replace the expiring REST API certificate.
• Apply the newly generated certificate to the remaining manager nodes individually.
• Leveraging the native self-signed certificate generation tool inside the NSX Manager GUI simplifies the replacement workflow, safely clearing the certificate expiration alarm directly from the interface without requiring manual API execution or external CSR management.