NSX UI Prevents Deletion of Stale Certificate with "Used by 0" Status Due to Load Balancer Dependency

Products

• VMware NSX

Issue/Introduction

In VMware NSX, administrators may be unable to delete an expired or stale certificate even after a new certificate has been issued and assigned.

• An expired or old Service Certificate cannot be deleted from the NSX UI.
• The UI displays the certificate status as Used by 0.
• Attempts to delete the certificate return the following error: One or more relationships exist for object with id Certificate/[UUID] from LoadBalancerMonitor/[UUID].

Environment

• VMware NSX 4.x
• Configuration: Load Balancer configured with HTTPS Monitors using Service Certificates.

Cause

This issue is caused by a synchronization mismatch between the Policy API (UI intent) and the Management Plane (actual realization).

1. A new certificate was uploaded with an incorrect chain order (e.g., Root > Intermediate > Leaf).
2. The NSX UI accepted the certificate upload without validation errors.
3. The Load Balancer Monitor was updated to use the new certificate; the UI reported success and showed the old certificate as having 0 usages.
4. Root Cause: In the background, the Management Plane failed to "realize" (activate) the new certificate because of the invalid chain order. Consequently, the Load Balancer Monitor's internal backing object continued to reference the old certificate, maintaining a hidden dependency that prevents its deletion.

Resolution

This is a known issue impacting VMware NSX. Subscribe to this KB article to be updated if a fix version becomes available.

Workaround:

To resolve the dependency and allow the deletion of the stale certificate, the new certificate must be re-imported with the correct chain order.

1. Correct the Certificate Chain: Ensure the new certificate PEM bundle is ordered as: Leaf Certificate > Intermediate Certificate(s) > Root Certificate.

2. Re-upload the Corrected Certificate: In the NSX UI, navigate to System > Certificates and re-import or update the certificate entry with the corrected PEM bundle.

3. Re-apply to the Load Balancer Monitor: Navigate to the Load Balancer Monitor settings and re-select the corrected certificate. Save the changes to trigger a new reconciliation cycle.

4. Delete the Stale Certificate: Once the Management Plane successfully realizes the new certificate, the internal reference to the old certificate is removed. You can now delete the expired/old certificate from the UI.

Additional Information

You can verify the PEM order using OpenSSL before uploading: Review this command before running it:

openssl crl2pkcs7 -nocrl -certfile <cert_bundle.pem> | openssl pkcs7 -print_certs -noout