SDDC Manager cannot update NSX Manager credentials – PKIX path building failed

Products

• VMware Avi Load Balancer

Issue/Introduction

• Password rotation launched from SDDC Manager fails immediately, before meaningful progress.
  
• NSX-related accounts in SDDC Manager is shown as Disconnected.
• Timing correlates with a recent change made directly in the Avi Controller GUI rather than through SDDC Manager (a certificate change is the common trigger).

Environment

• VCF 5.2.4
• Avi Load balancer 30.2.7

 

Cause

In a VCF 5.x deployment, SDDC Manager is the source of truth for the components it manages, including the Avi Controller. It stores its own record of the controller's identity and trust material (certificate/thumbprint) and expects that to match what the controller presents.

When a change — most often a certificate replacement — is applied directly in the Avi GUI, SDDC Manager's stored copy no longer matches what the controller now presents. The trust/thumbprint check fails, the account is marked disconnected, and any workflow that depends on that trusted channel (such as an NSX update) fails immediately.

This is configuration drift: two systems that must agree on the controller's certificate no longer do, because the change was made on only one side.

 

Resolution

The fix is to remove the out-of-band change and re-apply it through the managed workflow so both sides agree again.

1. Revert the certificate in the Avi GUI to its prior/default state.(Administration>System-settings>SSL) This returns the controller to the certificate SDDC Manager still expects and clears the immediate mismatch.
2. Re-apply the new chain certificate through the SDDC Manager workflow, not the Avi GUI. Driving the change through SDDC Manager updates both its stored trust record and the controller together, so no drift is created.
3. Retry the password rotation again for NSX manager. With the account healthy it should proceed.