JWT signature verification FAILED while extracting certificate chain. Admin must edit compute manager to resolve

Products

• VMware Cloud Foundation

Issue/Introduction

During a brownfield VCF upgrade from NSX 4.2.1 or earlier, the NSX Upgrade Finalize process can get stuck at the NSX Edge Cluster Upgrade / Finalize step, even though vCenter and ESXi for that domain have already upgraded successfully. VCF Ops displays:

"NSX Dataplane upgrade is not available for domain since all vCenter and ESX on the dependent domains are not upgraded..."

In the NSX UI (System > Fabric > Hosts), the affected host displays:

"Failed to manage NSX optional services on the host. Error: Connection error for . JWT signature verification FAILED for while extracting certificate chain. Admin must edit compute manager to resolve."

Although the host has already exited Maintenance Mode and finished upgrading in vCenter, NSX still reports it as failed, blocking the domain's upgrade Finalize step.

Environment

VMware Cloud Foundation 9.1.1

Cause

There is a timing race between vCenter's certificate rotation and an NSX host-upgrade activity. When vCenter rotates its certificate mid-login, NSX's proton service correctly re-pins the new leaf certificate in memory, but on the 4.2.1 upgrade path, the next step (VC version check) during vCenter login does not carry the compute-manager ID needed to recognize that pin. As a result, NSX incorrectly falls back to CA-chain validation, which fails until NSX's inventory service separately imports the new root a few minutes later.

If a host-upgrade step (e.g., managing DFW as an optional service) runs during that few-minute window, it fails with the JWT/certificate error above. The connection self-heals shortly after, but the host's failed status is not automatically retried, so it can stay stuck for hours until manually resolved.

Resolution

Log in to NSX Manager.

• Navigate to System > Fabric > Compute Managers.
• Select the affected Compute Manager and click Edit.
  • 
• Click SAVE without making any changes. NSX will detect the new certificate thumbprint and prompt you to confirm it.
  
  • 
• Click CONFIRM to accept the new thumbprint, import the valid root certificate, and complete re-registration.
  
  • 
• Verify that the Connection Status shows Up.
  
• Go to System > Fabric > Hosts, select the affected host, and click Resolve.
• Once it shows Up, resume the NSX Edge upgrade and Finalize step from VCF Ops.
  • 

Additional Information

• This issue only affects environments upgrading from NSX 4.2.1 or earlier that experience a vCenter certificate rotation during the same upgrade window.
• This issue occurs only when both the root and leaf certificates are changed in vCenter using a new CA that is not yet trusted by NSX.
• Usually, the vCenter certificate syncs within a few minutes. Before editing the Compute Manager, try resolving the error for the affected host under System > Fabric > Hosts. If that does not succeed, you can edit the Compute Manager under System > Fabric > Compute Managers.