NSX certificate are not properly replaced in NSX Manager UI even if VCF Operations Fleet Management is successful

Products

• VCF Operations

Issue/Introduction

• Having trouble replacing the certificates for the NSX Manager via VCF Operations lyfecycle
• The "Fleet Management" workflow reported a successful custom CA-signed TLS certificate replacement, but the new certificate is not assigning to the NSX GUI. 
• The CA certificate is loaded into all three NSX Manager nodes and is correctly visible in the UI.
• NSX Manager continue to use the old certificate and shows the certificate used by set to 0 .

Environment

VMware Cloud Foundation Operations Version: 9.0.2.0
VMware NSX Version 9.0.2.0

Cause

This issue is specific to SDDC Manager's certificate-management orchestration. The certificate details in SDDC Manager will not refresh immediately after a replacement.

They will instead pick up either from the existing daily scheduled job (default: once every 24 hours) or immediately the next time someone opens the Certificates tab in the SDDC Manager UI, which triggers a live refresh on its own.

Resolution

This issue will be fixed on the SDDC Manager side for 9.0.x on a future release.  From 9.1.0 onward, certificate replacement operations no longer goes through sddc-manager component, so this issue won't occur there. 

Workaround

Here the steps to prevent it from over-writing a genuine failure with a false SUCCESSFUL which need to be executed on the SDDC Manager appliance:

1. Add/edit the override properties file: 

   vi /etc/vmware/vcf/operationsmanager/application.properties

2. Add this line:

    certificates.update.cert.in.db.after.replacement=false

3. Restart the service to apply it: 

    systemctl restart operationsmanager

Note: This workaround is validated on 9.0.x releases only.