NSX Manager Deployment Fails with "Connection Refused" During Workload Domain Import in VMware Cloud Foundation
search cancel

NSX Manager Deployment Fails with "Connection Refused" During Workload Domain Import in VMware Cloud Foundation

book

Article ID: 447923

calendar_today

Updated On:

Products

VCF Operations

Issue/Introduction

During the "Import Existing vCenter" workflow in VMware Cloud Foundation (VCF), the "NSX Manager deployment task" fails. The SDDC Manager is unable to establish communication with the newly deployed NSX Manager appliance.

Symptoms:

  • The deployment task in the VCF Operations console hangs or fails.
  • The domainmanager.log contains the following error: ERROR [c.v.evo.sddc.common.util.SslUtil] Error occurred while getting certificate chain for 'NSX-MANAGER-FQDN:443'. java.net.ConnectException: Connection refused
  • The NSX Manager appliance is powered on but does not respond to HTTPS (port 443) or SSH requests.

    /var/log/vmware/vcf/domainmanager/domainmanager/log

YY-MM-DDTHH:MM:SS ERROR [vcf_dm,6a5##################643,d84a] [c.v.evo.sddc.common.util.SslUtil,dm-exec-26]  Error occurred while getting certificate chain for '<NSX FQDN>:443'.
java.net.ConnectException: Connection refused
        at java.base/sun.nio.ch.Net.connect0(Native Method)
        at java.base/sun.nio.ch.Net.connect(Net.java:579)
        at java.base/sun.nio.ch.Net.connect(Net.java:568)
        at java.base/sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:593)
        at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327)
        at java.base/java.net.Socket.connect(Socket.java:633)
        at org.bouncycastle.jsse.provider.ProvSSLSocketDirect.connect(ProvSSLSocketDirect.java:170)
        at org.bouncycastle.jsse.provider.ProvSSLSocketBase.implConnect(ProvSSLSocketBase.java:135)
        at org.bouncycastle.jsse.provider.ProvSSLSocketDirect.<init>(ProvSSLSocketDirect.java:107)
        at org.bouncycastle.jsse.provider.ProvSSLSocketDirect_8.<init>(ProvSSLSocketDirect_8.java:47)
        at org.bouncycastle.jsse.provider.ProvSSLSocketDirect_9.<init>(ProvSSLSocketDirect_9.java:43)
        at org.bouncycastle.jsse.provider.SSLSocketUtil.create(SSLSocketUtil.java:54)
        at org.bouncycastle.jsse.provider.ProvSSLSocketFactory.createSocket(ProvSSLSocketFactory.java:45)
        at com.vmware.evo.sddc.common.util.SslUtil.getCertificateChain(SslUtil.java:128)
        at com.vmware.evo.sddc.common.util.SslUtil.getCertificateChain(SslUtil.java:113)
        at com.vmware.vcf.common.nsxt.sdk.client.connection.NsxtConnectionFactory.openManagerConnectionWithTempTrustStoreHelper(NsxtConnectionFactory.java:89)
        at com.vmware.vcf.common.nsxt.sdk.client.connection.NsxtConnectionFactory.openManagerConnectionWithTrustOnFirstUse(NsxtConnectionFactory.java:82)
        at com.vmware.vcf.common.fsm.plugins.nsxt.action.DeployNsxtManagerAction.getManagementClusterStatus(DeployNsxtManagerAction.java:427)
        at com.vmware.vcf.common.fsm.plugins.nsxt.action.DeployNsxtManagerAction.lambda$deployNsxtManager$1(DeployNsxtManagerAction.java:241)
        at com.vmware.vcf.common.fsm.plugins.nsxt.helpers.NsxtCommonOperations.waitForState(NsxtCommonOperations.java:144)
        at com.vmware.vcf.common.fsm.plugins.nsxt.action.DeployNsxtManagerAction.deployNsxtManager(DeployNsxtManagerAction.java:237)
        at com.vmware.vcf.common.fsm.plugins.nsxt.action.DeployNsxtManagerAction.lambda$execute$0(DeployNsxtManagerAction.java:200)
        at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1768)
        at com.vmware.vcf.common.tracing.TraceRunnable.run(TraceRunnable.java:63)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        at java.base/java.lang.Thread.run(Thread.java:840)

Environment

  • VMware Cloud Foundation 9.x

Cause

This issue occurs when mandatory appliance credentials (specifically the root and audit passwords) are omitted or structurally incomplete during the Workload Domain creation wizard. Without these credentials, the NSX Manager OVF deployment fails to properly initialize the guest operating system, preventing core management services (like the reverse proxy on port 443) from starting.

Resolution

To resolve this issue, perform a clean redeployment with the required credentials:

  1. Log in to the vCenter Server and power off/delete the partially deployed NSX Manager VM to avoid IP or FQDN conflicts.
  2.  Return to the VCF Operations UI and initiate a new Import Workload Domain workflow.
  3.  On the NSX Configuration screen, ensure that the Root, Admin, and Audit account passwords are fully populated.
  4. Confirm that the passwords meet VMware's minimum complexity requirements.
  5.  Proceed through the validation phase and initiate the automated deployment task.
Powered by Wolken Software