NSX Upgrade Precheck Fails Due to Manager Certificate Hostname Mismatch.

Products

• VMware NSX
• VMware Cloud Foundation

Issue/Introduction

• VMware NSX Upgrade Coordinator halts during the "NSX UPGRADE STAGE MANAGER PRECHECK" phase.
• The upgrade cannot proceed, and the user interface surfaces a critical hostname mismatch exception.
• The following exact error message is recorded:
  

  nsxmgr_fqdn - NSX manager has a common name that does not match its hostname. Ensure that NSX manager has a valid certificate with its common name matching the host name.

Environment

VMware NSX
VMware Cloud Foundation

Cause

1. The precheck validation failure is caused by fragmented and desynchronized certificate bindings across the NSX management plane.
2. The MGMT_CLUSTER service is bound to a certificate that only contains the VIP FQDN in the Subject Alternative Name (SAN) field.
3. Furthermore, the primary API certificate (containing all required NSX Manager FQDNs and the VIP FQDN) is improperly bound to only a single node, while a secondary, incorrect API certificate is bound to the remaining nodes.

Resolution

1. Identify the correct primary certificate ID (<cert-id>) that contains all necessary FQDNs in its SAN field, as well as the UUIDs (<node-id>) of the misconfigured NSX Manager nodes.
   Refer Finding Node IDs for Certificate API Calls

2. Reassign the primary API certificate to the misconfigured NSX Manager nodes by executing the following API payload against the active NSX Manager:
   POST /api/v1/trust-management/certificates/<cert-id>?action=apply_certificate&service_type=API&node_id=<node-id>

3. Reassign the correct primary certificate to the Management Cluster VIP by executing the following API payload:
   POST /api/v1/trust-management/certificates/<cert-id>?action=apply_certificate&service_type=MGMT_CLUSTER

4. Retrigger the upgrade.

Additional Information

To know more about NSX API usage, refer NSX API usage