Disabling TLS v1.1 on NSX Management Plane 4.x
search cancel

Disabling TLS v1.1 on NSX Management Plane 4.x

book

Article ID: 450465

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

Symptoms:

  • Security vulnerability scanners (e.g., Qualys, Nessus) report "TLS Version 1.1 Deprecated Protocol" on the NSX Manager IP.
  • The curl command curl -v -k GET https://<NSX-Manager-IP>/api/v1/cluster/api-serviceshows TLS v1.1 as enabled=true, even on versions 4.1.1 or higher where it is expected to be disabled.
  • You cannot find a setting in the NSX Manager UI to disable the protocol for the management plane (Port 443).

Environment

VMware NSX 4.x

Cause

In environments upgraded from NSX versions prior to 4.1.1, the TLS v1.1 configuration may persist as "enabled" in the api-service configuration. While newer versions have this disabled by default for fresh installs, the setting is preserved during the upgrade to maintain compatibility.

Resolution

You must manually disable the protocol using the NSX API.

  1. Export the current configuration: Run the following command to save the current settings to a file: curl -k -u admin -X GET https://<NSX-Manager-IP>/api/v1/cluster/api-service > api_config.json

  2. Modify the configuration: Open api_config.json and locate the protocol_versions section. Change the enabled value for TLSv1.1 to false.

    json
     
    {  "name": "TLSv1.1",  "enabled": false}

  3. Apply the update: Submit the modified file back to the NSX Manager using a PUT request. You must include the X-Allow-Overwrite: true header. curl -k -u admin -X PUT -H "Content-Type: application/json" -H "X-Allow-Overwrite: true" -d @api_config.json https://<NSX-Manager-IP>/api/v1/cluster/api-service

  4. Verify the change: Run the GET call again or attempt a curl connection using TLS 1.1 to confirm the connection is now refused.

Impact/Note: Applying this change triggers a restart of the NSX reverse-proxy service. You will experience a management plane blackout (API and UI unavailability) for approximately 60–90 seconds. There is no impact to data plane traffic.

Additional Information

Related KB's

TLS v1.1 disabled by default from NSX 4.1.1

Disable/Enable VMware NSX Manager/Global manager Ciphers or TLS Settings

 

Powered by Wolken Software