Unable to connect to the compute manager as its trusted root certificate cannot be found

Products

• VMware NSX
• VMware Cloud Foundation

Issue/Introduction

After a vCenter root certificate is replaced , the connection between NSX and vCenter might break and cause the NSX Compute Manager Connection Status to be Down on the System > Fabric > Compute Managers NSX UI. Clicking Down displays the following error message:

Unable to connect to the compute manager <Compute Manager Host Name> as its trusted root certificate cannot be found. Validate the certificate chain in vCenter and then re-register the compute manager by editing it

Environment

VMware NSX 

VMware Cloud Foundation 

Cause

When the vCenter root certificate is replaced, vCenter Server presents the new certificate on every connection NSX initiates. NSX does not trust this certificate because it still has the previous root certificate stored for that Compute Manager. As a security measure, NSX blocks the connection until the new root certificate is imported.

Resolution

Step 1: Log in to NSX Manager.

Step 2: Navigate to System > Fabric > Compute Managers.

Step 3: Select the affected Compute Manager and click Edit.

Step 4: Click SAVE without making any changes. NSX detects the new certificate thumbprint and prompts you to confirm it.

Step 5: Click CONFIRM to accept the new thumbprint, import valid root certificate and complete re-registration.

Step 6: Verify that the Connection Status shows Up.

 

Additional Information

To verify the current vCenter Server certificate thumbprint explicitly, run the following command from the vCenter Server Appliance Shell:

echo | openssl s_client -connect localhost:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256

Example output:
sha256 Fingerprint=##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##

'Certificate chain of Compute Manager is invalid' error - follow https://knowledge.broadcom.com/external/article/372076

'Compute Manager certificate is expired' error - follow https://knowledge.broadcom.com/external/article/404998

'Failed to remove NSX ownership' error - follow https://knowledge.broadcom.com/external/article/403570