Upgrade validation fails with signed fields invalid error - VMware NSX

Products

• VMware NSX
• VMware Tanzu Kubernetes Grid Integrated Edition
• VMware Cloud Foundation

Issue/Introduction

During the NSX Manager upgrade precheck, the validation fails due to a certificate parsing error. This occurs when the upgrade coordinator identifies a certificate with a structural format issue.

 

Symptoms
The following error appears in the NSX Manager UI or Upgrade Coordinator logs: 

The certificate with id [ID] failed to parse with error: signed fields invalid. Please delete (if unused) or replace this certificate prior to upgrading.

 

Environment

VMware Cloud Foundation (VCF) 5.x
VMware NSX 4.1.x, 4.2.x
VMware Tanzu Kubernetes Grid Integrated (TKGI)

Cause

Newer NSX versions (starting with 4.2.x) utilize strict JVM parsing rules. This error occurs because the certificate pem_encoded field incorrectly includes the Private Key within the public certificate PEM block, which is a structural violation and security risk.

Resolution

If the certificate is in use by a Principal Identity (PI), it cannot be deleted directly. Follow this "swap" procedure:

1. 1. Log in to the NSX Manager UI and navigate to System > Certificates.
   2. Select Generate CSR to create a temporary self-signed certificate. Note the New-Cert-ID.
   3. Identify the Principal Identity using the malformed certificate via API: GET https://<nsx-mgr-ip>/api/v1/trust-management/principal-identities
   4. Update the Principal Identity to use the temporary certificate using the following API call (requires X-NSX-Username: admin header): POST https://<nsx-mgr-ip>/api/v1/trust-management/principal-identities?action=update_certificate JSON Payload:

{
  "principal_identity_id": "<PI-ID>",
  "certificate_id": "<New-Cert-ID>"
}

 

            5. Delete the malformed certificate from the NSX UI.

 

            6. Re-import the certificate correctly. Ensure only the public chain is in the Certificate Contents field and the Private Key field remains empty.

 

            7. Repeat Step 4 to re-assign the PI to the corrected certificate ID.

 

            8. Delete the temporary self-signed certificate.

Additional Information

Importing Certificates into NSX

KB 142814 : VCF Release Information.

KB 275360 : How to subscribe to Broadcom articles.