Failed to generate CSR for NSX_NODE due to I/O error on GET request for "https://NSX_NODE/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE> doesn't match any of the subject alternative names: [NSX_VIP,VIP_IP_ADDRESS]

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

Trying to replace the certificates of NSX nodes using SDDC Manager will fail with error:

"Failed to generate CSR for NSX_NODE due to I/O error on GET request for "https://NSX_NODE/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE> doesn't match any of the subject alternative names: [NSX_VIP,VIP_IP_ADDRESS]"

 

Log sample:

YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,#######_OPERATION_ID_#######,b3b1] [c.v.v.c.n.NsxTManagerCertificatePluginService,om-exec-6] CSR generation failed for NSX_NODE2.FQDN: I/O error on GET request for "https://NSX_NODE2.FQDN/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE2.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,#######_OPERATION_ID_#######,22a9] [c.v.v.c.n.NsxTManagerCertificatePluginService,om-exec-30] CSR generation failed for NSX_NODE1.FQDN: I/O error on GET request for "https://NSX_NODE1.FQDN/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE1.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,#######_OPERATION_ID_#######,8a73] [c.v.v.c.n.NsxTManagerCertificatePluginService,om-exec-21] CSR generation failed for NSX_NODE3.FQDN: I/O error on GET request for "https://NSX_NODE3.FQDN/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE3.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,#######_OPERATION_ID_#######,8a73] [c.v.v.c.n.NsxTManagerCertificatePlugin,om-exec-21] Unable to generate CSR for resource: NSX_NODE3.FQDN
com.vmware.vcf.certmgmt.exceptions.CsrGenerationException: I/O error on GET request for "https://NSX_NODE3.FQDN/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE3.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
        at com.vmware.vcf.certmgmt.nsx_t.NsxTManagerCertificatePluginService.buildCsrApiRequest(NsxTManagerCertificatePluginService.java:419)
        ...
        at com.vmware.vcf.certmgmt.nsx_t.NsxTManagerCertificatePlugin$$SpringCGLIB$$0.generateCsr(<generated>)
        at com.vmware.vcf.certmgmt.service.orch.impl.CertificateOperationOrchestratorImpl.getCsrFromResource(CertificateOperationOrchestratorImpl.java:818)
        at com.vmware.vcf.certmgmt.service.orch.impl.CertificateOperationOrchestratorImpl.lambda$createCertificateOperationTask$7(CertificateOperationOrchestratorImpl.java:387)
        ...
Caused by: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://NSX_NODE3.FQDN/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE3.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
        at org.springframework.web.client.RestTemplate.createResourceAccessException(RestTemplate.java:890)
        ...
Caused by: javax.net.ssl.SSLPeerUnverifiedException: Certificate for <NSX_NODE3.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
        at org.apache.hc.client5.http.ssl.TlsSessionValidator.verifySession(TlsSessionValidator.java:115)
        ...
YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,#######_OPERATION_ID_#######,b3b1] [c.v.v.c.n.NsxTManagerCertificatePlugin,om-exec-6] Unable to generate CSR for resource: NSX_NODE2.FQDN
com.vmware.vcf.certmgmt.exceptions.CsrGenerationException: I/O error on GET request for "https://NSX_NODE2.FQDN/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE2.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
        at com.vmware.vcf.certmgmt.nsx_t.NsxTManagerCertificatePluginService.buildCsrApiRequest(NsxTManagerCertificatePluginService.java:419)
        ...
Caused by: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://NSX_NODE2.FQDN/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE2.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
        ...
Caused by: javax.net.ssl.SSLPeerUnverifiedException: Certificate for <NSX_NODE2.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
        ...
YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,#######_OPERATION_ID_#######,22a9] [c.v.v.c.n.NsxTManagerCertificatePlugin,om-exec-30] Unable to generate CSR for resource: NSX_NODE1.FQDN
com.vmware.vcf.certmgmt.exceptions.CsrGenerationException: I/O error on GET request for "https://NSX_NODE1.FQDN/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE1.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
        ...
Caused by: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://NSX_NODE1.FQDN/api/v1/cluster/nodes/deployments": Certificate for <NSX_NODE1.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
        ...
Caused by: javax.net.ssl.SSLPeerUnverifiedException: Certificate for <NSX_NODE1.FQDN> doesn't match any of the subject alternative names: [NSX_VIP.FQDN, VIP_IP_ADDRESS]
        at org.apache.hc.client5.http.ssl.TlsSessionValidator.verifySession(TlsSessionValidator.java:115)
        ...
YYYY-MM-DDTHH:MM:SS INFO  [vcf_om,#######_OPERATION_ID_#######,8a73] [c.v.v.c.s.o.i.CertificateOperationOrchestratorImpl,om-exec-21] Received CSR null from resource: NSX_NODE3.FQDN
YYYY-MM-DDTHH:MM:SS INFO  [vcf_om,#######_OPERATION_ID_#######,22a9] [c.v.v.c.s.o.i.CertificateOperationOrchestratorImpl,om-exec-30] Received CSR null from resource: NSX_NODE1.FQDN
YYYY-MM-DDTHH:MM:SS INFO  [vcf_om,#######_OPERATION_ID_#######,b3b1] [c.v.v.c.s.o.i.CertificateOperationOrchestratorImpl,om-exec-6] Received CSR null from resource: NSX_NODE2.FQDN

 

 

 

 

 

Environment

SDDC Manager 5.2.x

NSX 4.x

 

Cause

Certificates of the nodes are required to also have the VIP name in the SAN to allow the authentication SSDC Manager performs to the node will succeed.

 

Resolution

1. Replace the certificate of the VIP using SDDC Manager making sure it will have the following SAN:
   vip.fqdn,node1.fqdn,node3.fqdn,node3.fqdn (adding vip_ip_address and nodes_ip_address is not mandatory but it also possible if required on environment)
   
   
2. Use the steps of Replace Certificates Through API to add the ID of the VIP to the NSX nodes certificates making sure the certificates will have the following composition:
   Considering a VIP + 3 NSX nodes

• • SAN of Node1 must have: vip.fqdn,node1.fqdn
  • SAN of Node2 must have: vip.fqdn,node2.fqdn
  • SAN of Node3 must have: vip.fqdn,node3.fqdn