K8S_MSG_CLIENT certificates can not be deleted after NAPP undeployment, causing expired certificate alarm on NSX Manager.

Products

• VMware NSX

Issue/Introduction

After NAPP undeployment, the K8S_MSG_CLIENT is left behind and cannot be deleted.

Even after involving GSS to delete the certificate, it gets added back to the Certificates UI after a while.

This certificate eventually expired and causing certificate expiry alarms that can not be resolved.

Environment

Any NSX version on which NAPP 4.2 is undeployed.

Cause

The certificate was written on disk when left behind. Removing the certificate from the trust-management system does not clean up the on-disk copy.

As a result, the system tries to repair itself after reboot and reintroduce the certificate back to the database.

Resolution

To resolve this issue, you can run the CARR script. Please refer to Broadcom KB 369034 for instructions.

If the issue persists after running the CARR script, please contact Global Support Services (GSS) and reference Broadcom KB 393976 for further investigation.