NSX Advanced Load Balancer Password Rotation Fails in SDDC Manager with Certificate Expired Error
search cancel

NSX Advanced Load Balancer Password Rotation Fails in SDDC Manager with Certificate Expired Error

book

Article ID: 451023

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • In VMware Cloud Foundation (VCF) environments, attempts to rotate passwords for NSX Advanced Load Balancer (Avi) service accounts via SDDC Manager or VCF Operations may fail.
  • While the service accounts are visible in the Password Management dashboard, the management options (such as Remediate or Rotate) may appear greyed out or unavailable.
  • Password rotation for Avi service accounts (e.g., svc-vavi-####) fails with a status of Fail.
  • The SDDC Manager UI displays the account as Disconnected.
  • The error massage that will be seen:
    `Failed to update user credential in Avi Load Balancer Controller Cluster. Cause: InvalidRequest (com.vmware.vapi.std.errors.invalid_request) (statusCode:400) => {error_message=I/O error on POST request for "https://<avi_controller_ip>/api/authtoken": Certificate expired for CN=<avi_controller_fqdn>; nested exception is javax.net.ssl.SSLHandshakeException: Certificate expired...

Environment

  • Product: VMware Cloud Foundation 9.x
  • Component: SDDC Manager, NSX Advanced Load Balancer (Avi)
  • Configuration: VCF Management or Workload Domains utilizing Avi Load Balancer.

Cause

  • The failure is caused by an expired SSL certificate on the Avi Load Balancer Controller Cluster.
  • Because SDDC Manager communicates with Avi via API for credential operations, an expired certificate breaks the SSL handshake, resulting in a `400 Bad Request`.
  • Additionally, in certain VCF versions, direct lifecycle management of Avi certificates and passwords via the VCF management appliances is restricted, requiring manual intervention within the Avi Controller interface.

Resolution


To resolve this issue, the Avi Controller certificate must be renewed manually before the password rotation can be synchronized in SDDC Manager

  • Ensure you have admin access to the Avi Load Balancer Controller UI.

Prepare the new CA-signed certificate and its corresponding private key.

Note: This is supported by the AVI Load Balancer support tea. If assistance is needed open a case with the AVI team.

Step 1: Renew the Avi Controller Certificate

  1. Log into the Avi Load Balancer UI.
  2. Navigate to Templates > Security > SSL/TLS Certificates.
  3. Locate the expiring or expired certificate used for the Controller/Portal.
  4. Click Import to add the new signed certificate.
  5. Important: When adding the new certificate, check the Overwrite option and use the exact same Name (alias) as the expiring certificate. This ensures that existing service bindings are maintained.
  6. Provide the signed certificate and the private key, then click Save.

Step 2: Manually Reset or Synchronize Avi Local User Password

If the password for the service account has already expired locally on the Avi Controller:

  1. In the Avi Load Balancer UI, navigate to Administration > Accounts > Users.
  2. Select the affected service account and click Edit.
  3. Set the password to match the current intended credential (or the one stored in SDDC Manager).
  4. Alternatively, if you are logged in as that user, click your username in the top-right corner and select My Account to update the password.

Step 3: Remediate in SDDC Manager

  1. Log into the SDDC Manager UI.
  2. In the navigation pane, click Administration > Password Management.
  3. Locate the NSX Advanced Load Balancer component.
  4. Click the vertical ellipsis (three dots) next to the affected account and select Remediate.
  5. Follow the prompts to synchronize the password state. The status should now change to Active (Green).

 

 

 

 

Additional Information

For environments where the NSX Manager still reports the Avi Controller as "Not Reachable" after certificate replacement, refer to:

Powered by Wolken Software