Certificate replacement fails in VCF Ops with error "Private key does not match with the certificate"

Products

• VMware NSX
• VCF Operations

Issue/Introduction

• A certificate was created in VCF Ops Fleet Management that contains Subject Alternative Names (SANs) for multiple components, such as the NSX VIP as well as each of the NSX Managers. 
• The certificate was successfully applied to one component, such as the NSX VIP. 
• Attempts to perform a certificate replacement operation for additional components, such as the individual NSX Manager nodes, fails with the following error;

Error Code: certificate.upload.error
 certificate.upload.error
 Certificate task REPLACE_CERTIFICATE for <NSX-Manager-FQDN> has failed. Error message: Unable to upload certificate against CSR ID fba6e568-####-####-####-75d209eab46e on NSX for replace certificate operation with error message : Private key does not match with the certificate.. Please check VIM adapter logs and task status for more details.

Environment

VCF Operations 9.x
VCF Fleet Management 9.x
VCF NSX 9.x

 

Cause

VCF Operations is expecting a 1 to 1 relationship between certificates and components. 

Resolution

Workaround 1

• Create a unique certificate for each component in VCF Operations to form a 1 to 1 relationship between each certificate and component. 
  • Replace a Certificate with a CA-Signed Certificate
  • Replace a Certificate with an External CA-Signed Certificate

Workaround 2

1. Apply the certificate to the NSX VIP component in VCF Ops Fleet Management. 
2. Navigate to the NSX UI and apply the same certificate that contains the 4 SANS to each of the NSX Manager nodes API services so that the certificate is being used as intended by the VIP and each node. 
   1. See Replace NSX Certificates from NSX Manager.
3. Return to the VCF Ops UI and perform an 'Inventory Sync' which will update Ops that each of the 4 NSX Components are using the same certificate. 

Additional Information

Certificate replacement fails in VCF Fleet Manager: "Public key in CSR and server certificate are not matching" across VCF Components