Error: com.vmware.nsx.management.truststore.exceptions.AphArFedConfigurationException during APH-AR certificate replacement in NSX Federation

Products

• VMware NSX

Issue/Introduction

In an NSX Federation environment (version 4.2.x or higher), replacing an expired APH-AR (Appliance Proxy Hub - Async Replicator) certificate fails via the UI or the CARR script.

• UI Error: "General error has occurred" (Error Code 100/500).
• CARR Script/Log Error:

com.vmware.nsx.management.truststore.exceptions.AphArFedConfigurationException: Site (####), GM node count (1). At least 2 nodes are expected in a site.

• The Local Manager (LM) shows the Global Manager (GM) status as "Disconnected" or "Not Available."
• The LM local inventory incorrectly reports only one node in the GM cluster.

Environment

• VMware NSX 4.2.x and higher
• NSX Federation with Local and Global Managers

Cause

When the APH-AR certificate expires, the communication channel (Async Replicator) between the GM and LM collapses. NSX 4.2.x validation logic requires at least 2 nodes to be detected for federation certificate operations.

Resolution

1. If the Global Manager (GM) site contains only one node, add a second Global Manager node to the cluster. A minimum of two nodes is required for federation certificate validation in NSX 4.2.x and higher.
2. If the CARR script continues to fail after verifying the cluster size, perform a manual synchronization between the Local Manager (LM) and Global Manager (GM) to refresh the stale inventory:
   • Log in to the Local Manager UI.
   • Navigate to System > Configuration > Location Manager.
   • Locate the Global Manager site cluster.
   • Select Edit Settings.
   • Manually re-enter the VIP/IP, Username, Password, and SHA-256 Thumbprint of the Global Manager.
   • Click Save.
3. Once the sync status returns to Active/Success, rerun the CARR script or perform the certificate replacement in the UI.