Stale certificate-expired alarm referencing an absent certificate object in VMware NSX

Products

• VMware NSX

Issue/Introduction

In VMware NSX, a certificate-expired alarm may remain in an OPEN state on a Local Manager or Global Manager even when the certificate inventory does not contain any expired certificates.

Symptoms:

• An alarm indicates a certificate has expired, but the referenced certificate ID (UUID) is not present in the current certificate inventory.
• The alarm persists despite successful source synchronization or system reboots.
• The alarm description typically reads: Certificate <UUID> has expired.

Environment

VMware NSX

Cause

The issue is typically caused by a stale alarm record in the NSX Alarm database. This occurs when a certificate that was previously present and expired has been deleted or replaced, but the associated alarm was not automatically cleared or suppressed by the system. Because the certificate object no longer exists, the system cannot perform a state check to "auto-resolve" the alarm.

Resolution

1. Attempt to resolve  the alarm in the NSX UI. If the alarm comes back to an Open state, move on to the next step.
2. Use the steps in the Resolution section of Manually resolve, acknowledge or suppress alarm on NSX Standby Global Manager to resolve the alarm via API. If the alarm does not resolve or comes back to an Open state, move on to the next step.
3. Restart the phonehome-coordinator service on all the manager nodes
   • /etc/init.d/phonehome-coordinator status    #Check the status of phonehome-coordinator
   • /etc/init.d/phonehome-coordinator restart   #Restart the phonehome-coordinator service
4. If the issue is not resolved, restart the proton service on all the NSX manager nodes. 
   
   Note: Make sure the proton service is up and the cluster is stable before restarting the service on the second and third nodes. 
   • /etc/init.d/proton status    #Check the status of proton service
     /etc/init.d/proton restart   #Restart the proton service
     
     
5. If the alarm is still not resolved after restarting the phonehome-coordinator and proton services, proceed with rolling reboot of NSX manager nodes.

Additional Information

If issue persists, collect all the 3 NSX Manager node log bundles and open a support request with Broadcom.