Error: Execute CARR Script fails with 825-day validity requirement and CSR generation failure on SDDC Manager
Article ID: 448004
Updated On:
Products
Issue/Introduction
During an upgrade of NSX-T Manager from version 4.2.3.3 to 4.2.4 within a VMware Cloud Foundation (VCF) 5.2.4 environment, the precheck fails at the "Execute CARR Script" stage. The SDDC Manager UI displays: Execute CARR Script to check certificate issues: [Invalid or self-signed certificates with expiry less than 825 days detected. Please click Resolve to replace expiring and expired certificates to proceed with the upgrade.]
When attempting to use the Resolve button, CSR generation fails for individual manager nodes with errors in /var/log/vmware/vcf/operationsmanager/operationsmanager.log: CSR generation failed for ####: I/O error on GET request for "https://####/api/v1/cluster/nodes/deployments": Certificate for doesn't match any of the subject alternative names: [####]
The SDDC manager logs show that the FQDN does not match SAN.2026-06-29T19:11:00.606+0000 ERROR [c.v.v.c.n.NsxTManagerCertificatePluginService,om-exec-6] CSR generation failed for <manager_node2>: I/O error on GET request for "https://<manager_node2>/api/v1/cluster/nodes/deployments": Certificate for <manager_node2> doesn't match any of the subject alternative names: [NSX_VIP, 172.##.##.##]2026-06-29T19:11:00.606+0000 ERROR [c.v.v.c.n.NsxTManagerCertificatePluginService,om-exec-30] CSR generation failed for <manager_node1>: I/O error on GET request for "https://<manager_node1>manager_node1[NSX_VIP, 172.##.##.##]2026-06-29T19:11:00.606+0000 ERROR [c.v.v.c.n.NsxTManagerCertificatePluginService,om-exec-21] CSR generation failed for <manager_node1><manager_node1>manager_node1[NSX_VIP, 172.##.##.##]
Environment
- VMware Cloud Foundation 5.2.4.0
- VMware SDDC Manager 5.2.4
- VMware NSX 4.2.3.3
Cause
VCF 5.2.4 enforces a new 825-day certificate validity requirement via the Certificate Analyzer, Results and Recovery (CARR) script. The automated remediation fails because the SDDC Manager 5.2.4 certificate plugin performs a strict SAN validation during the SSL handshake with individual NSX Manager nodes. If the nodes' current certificates do not contain the correct SANs (e.g., node FQDN and VIP FQDN), CSR generation is blocked.
Resolution
Follow these steps to manually satisfy the 825-day requirement:
- Generate Manual Certificates: Use an external tool (e.g., OpenSSL) to generate a new self-signed certificate for the NSX Manager cluster with a validity period greater than 825 days (e.g., 3650 days).
- Include SANs: Ensure the certificate includes the FQDN and IP of the Cluster VIP and all individual cluster nodes.
- Apply Certificate: Manually import and apply the certificate to the NSX Manager cluster using the NSX API or UI.
- Re-run Precheck: Navigate to SDDC Manager and re-run the NSX upgrade precheck. The CARR script will detect the new validity period and allow the upgrade to proceed.
- Post-Upgrade: Once the upgrade to NSX 4.2.4 is complete, use SDDC Manager to replace the temporary self-signed certificate with a standard CA-signed certificate.
Additional Information
If the certificates are NSX self-signed certificates, use the CARR script to renew the certificates. See Using Certificate Analyzer Resolver (CARR) Script to fix certificate related issues in NSX.
SAN validation failures during VCF validation workflows:
https://knowledge.broadcom.
NSX Manager upgrade fails with certificate expiry less than 825 days error in SDDC Manager
https://knowledge.broadcom.
Feedback
