NSX Native Load Balancers showing "Unknown" after upgrading NSX

Products

• VMware NSX

Issue/Introduction

Native Load Balancer status shows "Unknown" following an upgrade to NSX 4.2.4 or later. This article explains the impact of OpenSSL3 cryptographic standards on legacy certificates and provides steps for resolution.

• Load Balancer service status: Unknown.
• Error in Edge logs: `SSL_CTX_use_certificate(...) failed (SSL: error:0A00018E:SSL routines::ca md too weak)`.
• Error message: `Query LB Engine Failed`.

Environment

•  NSX 4.2.4 and later.
• Environments utilizing L7 Virtual Servers with older certificate signatures.
  

Cause

NSX 4.2.4 introduced OpenSSL3, which mandates stricter security compliance. Any Load Balancer instance configured with a SHA1-signed certificate will fail to validate. Because NSX compiles all Virtual Server (VS) configurations for an LB instance into a single `nginx.conf`, one failed L7 certificate validation crashes the entire Load Balancer instance, including co-located L4 Virtual Servers.

Resolution

1. Proactively identify weak certificates on your NSX Edge nodes using the following command:
   `openssl x509 -in <certificate_file>.crt -text -noout | grep "Signature Algorithm"`
   1. Non-compliant: `sha1WithRSAEncryption'
   2. Compliant: `sha256WithRSAEncryption` or higher.
2. Navigate to System > Certificates in the NSX UI and identify the SHA1-signed certificates identified in Step 1.
3. Replace identified certificates with SHA256-signed (or higher) certificates.
4. Remove the non-compliant SHA1 certificates from the Load Balancer configurations.
5. Verify Load Balancer status has returned to "Active".
   

Additional Information

Here is another related KB: Remediating NSX load balancer upgrade pre-check warnings for OpenSSL 3.0 compliance