Unable to connect to the compute manager as its server certificate cannot be found

Products

• VMware NSX

Issue/Introduction

Following a brownfield upgrade from NSX 9.0.x, the compute manager's connection status shows as "Down" after finalizing the upgrade.

NSX Compute Manager Connection Status to be Down on the System > Fabric > Compute Managers NSX UI. Clicking Down displays the following error message:

"Unable to connect to the compute manager <Compute Manager Host Name> as its server certificate cannot be found. Re-register the compute manager by editing it."

 

Environment

NSX 9.1.1.0 and above, upgrading from NSX 9.0.x.

Cause

During the upgrade phase, NSX automatically imports the Compute Manager’s Machine SSL certificate. However, due to an internal race condition, the certificate and its reference fail to update correctly.

Although NSX continues to trust vCenter (VC) via the Root CA certificate during the upgrade, strict usage of the Machine SSL certificate is enforced once the NSX upgrade is finalized. As a result, the VC connection fails and the Compute Manager status is marked as DOWN.

Resolution

1. Log in to NSX Manager.
2. Navigate to System > Fabric > Compute Managers.
3. Select the affected Compute Manager and click Edit.
   
4. Click SAVE without making any changes. NSX detects the new certificate thumbprint and prompts you to confirm it.
5. Click CONFIRM to accept the new thumbprint, import valid root certificate and complete re-registration.
   
6. Verify that the Connection Status shows Up.

Additional Information

After successful Edit operation it re-imports the the machine ssl certificate and writes it's reference id to ComputeManagerStatusModelMsg table.