NSX Manager UI is not available, Manager and HTTPS are down after Manager reboot or service restart

Products

• VMware NSX

Issue/Introduction

• NSX UI is down/inaccessible

• NSX Manager admin CLI get cluster status shows Manager and HTTPS down

• The issue started after NSX Manager reboot or after Manager service restart

• Restoring from backup fails with same services down.

• NSX Manager log /var/log/proton/proton-tomcat-wrapper.log shows an IllegalAccessError during truststore validation.

  INFO   | jvm 1    | <DATE> 16:40:20 | Exception in thread "CertificateChangeNotificationService" java.lang.IllegalAccessError: class com.vmware.nsx.management.truststore.service.impl.TrustStoreServiceImpl (in unnamed module @0xffd1c90) cannot access class sun.security.validator.ValidatorException (in module java.base) because module java.base does not export sun.security.validator to unnamed module @0xffd1c90

• NSX Manager log /var/log/proton/nsxapi.log reports failure to start the manager service with an IllegalAccessError:

  <DATE>T16:46:05.639Z ERROR WrapperStartStopAppMain ApplicationContextManager 5365 - [nsx@6876 comp="nsx-manager" errorCode="MP2112" level="ERROR" subcomp="manager"] Failed to start management application.
  org.springframework.context.ApplicationContextException: Failed to start bean 'writeCertStatus'; nested exception is java.lang.IllegalAccessError: class com.vmware.nsx.management.truststore.service.impl.TrustStoreServiceImpl (in unnamed module @0x259e35cd) cannot access class sun.security.validator.ValidatorException (in module java.base) because module java.base does not export sun.security.validator to unnamed module @0x259e35cd

Environment

VMware NSX 4.2.0.x and 4.2.1.x

Cause

This issue occurs when the Managers or the Manager service are restarted when an expired certificate exists in the system. Validation fails when the Manager service is initiating and the service fails to start. As a result HTTPS fails to start as it depends on Manager.

Resolution

This issue is resolved in VMware NSX 4.2.2 available at Broadcom downloads.

If you believe you have encountered this issue, open a support case with Broadcom Support and refer to this KB article. For more information, see Creating and managing Broadcom support cases.