NSX Federation connectivity failure between Global Manager and Local Manager due to expired APH certificates

Products

• VMware NSX

Issue/Introduction

In a VMware NSX Federation environment, Global Manager (GM) instances may fail to connect to Local Manager (LM) locations. This results in the site status appearing as Disconnected in both sites' NSX UI, preventing the synchronization of networking entities across the federation.

• Site status in Global Manager UI shows "Disconnected."
• New API cert has already being applied to GM and LM manager nodes.
• Log entries in the Global Manager syslog indicate certificate validation failures.
  

  • 2026-07-10T16:49:01.938Z <FQDN> NSX 73187 - [nsx@6876 comp="global-manager" subcomp="appl-proxy" s2comp="nsx-net" tid="<ID>" level="ERROR" errorCode="NET1111"] Certificate validation failed: 10-certificate has expired

• There might be a certificate pending deletion and "where used" shows as 0
• Further checking the certificate ID using API call GET /api/v1/trust-management/certificates/<cert-id> confirms the cert still has services attached

Environment

VMware NSX 4.2.x

Cause

The issue is caused by a stale certificate binding within the Appliance Proxy Hub (APH) service. Even when an expired CA-signed certificate is marked for deletion in the UI, the APH service may maintain an active binding to it, blocking the full removal and preventing the service from using newer certificates.

Additionally, this failure can be compounded if newly imported CA-signed certificates lack the required Subject Alternative Names (SANs) for all managers in the federation, which are mandatory for secure cross-site communication.

Resolution

To resolve this issue, you must manually release the APH service lock using self-signed certificates and then re-apply valid CA-signed certificates.

Prerequisites

• Ensure you have the corrective CA-signed certificates ready, including all manager FQDNs and VIPs in the SAN field.
• Perform a backup of the NSX Manager configuration before proceeding.

Steps

1. Remediate APH Service Binding:

   • Create a new self-signed certificate on each NSX Manager node.
   • Update the APH service to use the new self-signed certificate via the API. This action releases the service lock on the expired CA-signed certificate.
   • Delete the expired CA-signed certificate again from the System > Certificates menu.

2. Force Management Plane Cache Refresh:

   • Temporarily replace the VIP and API certificates with self-signed certificates. 
   • This forces the NSX Management plane to flush stale appliance proxy metadata and refresh its internal certificate store.

3. Restore Correct CA-Signed Certificates:

   • Import the corrected CA-signed certificates (ensuring all Peer SANs and Common Names are present).
   • Replace the temporary self-signed certs for VIP and API with the valid CA-signed versions.

4. Update Federation Site Connection:

   • In the Global Manager UI, navigate to System > Location Manager.
   • Edit the affected Location and click Save/Update to force a fresh synchronization handshake with the Local Manager using the new trust anchor.