VCD Edge Gateway API Fails with "PKIX path validation failed" Due to Expired NSX Manager Certificate

Products

• VMware NSX

Issue/Introduction

When attempting to view or modify Services (such as NAT, Firewall, or IPSec VPN) on an Edge Gateway within the VMware Cloud Director (VCD) Tenant or Provider portal, the operation fails.

The following red error banner is displayed at the top of the user interface:

Error: [xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx] I/O error on GET request for "https://<NSX-Manager-FQDN>:443/policy/api/v1/infra/tier-1s/.../nat/USER/nat-rules": PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed; nested exception is javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed - NotAfter: [Date/Time]

Environment

VMware NSX

Cause

This issue occurs due to a breakdown in the SSL/TLS handshake between the VCD cells and the NSX Manager API endpoints.

Expired Appliance Certificate: The management/API certificate bound to the NSX Manager nodes or the Management Cluster Virtual IP (VIP) has passed its NotAfter expiration date. The VCD Java runtime platform rejects the connection via its PKIX path validation process.

Resolution

Step 1: Generate a Certificate Signing Request (CSR) in NSX

1. Log directly into the NSX Manager UI as an administrator.
2. Navigate to System > Certificates and click on the CSRs tab.
3. Click Generate > Generate CSR.
4. Fill out the required certificate details:
   • Common Name (CN): The Fully Qualified Domain Name (FQDN) of your NSX Management Cluster VIP.
   • Subject Alternative Names (SAN): You must include the FQDNs and IP addresses of the Cluster VIP and all individual NSX Manager nodes.
5. Click Generate.
6. Select the newly created CSR, click Actions, and select Download CSR (or copy the PEM content).
7. Submit this CSR to your internal or public Certificate Authority (CA) to be signed.

Step 2: Import the Signed Certificate Chain

Once your CA provides the signed certificate, you must bundle it with the CA root/intermediates and import it back against the original CSR.

1. Open the signed certificate file from your CA in a text editor.
2. Build a complete certificate bundle by pasting the certificates back-to-back in this exact order:
   • Top: Leaf Certificate (The signed NSX Manager cert received from the CA)
   • Middle: Intermediate CA Certificate (if applicable)
   • Bottom: Root CA Certificate
3. In the NSX UI, return to System > Certificates > CSRs.
4. Select the check box next to the CSR you generated in Step 1.
5. Click Actions > Import Certificate for CSR.
6. Paste the complete certificate chain bundle into the text box.
7. Crucial: Ensure the toggle switch for "Service Certificate" is turned OFF (No). This ensures it imports as an Appliance certificate.
8. Click Import. The certificate will now move to the Certificates tab under the Appliance category.

Step 3: Apply the Certificate to the Management Plane

1. Go to the Certificates tab, click the vertical three dots (...) next to the newly imported Appliance certificate.
2. Select Apply Certificate and target the individual manager nodes and the management cluster VIP.

Step 4: Refresh and Trust the Certificate in VCD

1. Log into the VMware Cloud Director Provider Portal as a System Administrator.
2. Navigate to Resources > Infrastructure Resources > NSX Managers.
3. Select the affected NSX Manager instance and click Reconnect (or Edit).
4. VCD will discover the new certificate and display a security warning with the updated SSL thumbprint.
5. Click Trust / Accept to update the VCD database.