License Hub: Unable to assign licenses to Avi endpoints after an expired signing certificate

Products

• VMware Avi Load Balancer

Issue/Introduction

In a disconnected (offline) or air-gapped environment, an Avi Controller running 32.x that is licensed through License Hub may lose its valid licenses. You may see the following:

• Existing Virtual Services (VSes) and Service Engines (SEs) continue to function normally.
• New Service Engine creation fails. As a result, creating a new Virtual Service or scaling out an existing one may fail if it cannot be placed on an existing Service Engine.
• Upgrading to a later release fails with an error. A failed upgrade attempt has no impact on existing Virtual Services or Service Engines.

Environment

Component	Example	What happens	Action required
License Hub (license import fails)	A license file is downloaded on October 15. The signing certificate expires on October 17. The file is imported into License Hub on October 22.	License Hub rejects the import because the current date is later than the certificate's expiry date.	Download a new license file from the Cloud Console and upload it to License Hub.
Avi Controller (license sync fails)	The Controller syncs licenses from License Hub.	The Controller cannot validate any of the licenses, treats the result as zero valid licenses, and removes all of its existing licenses. It then runs unlicensed, which blocks new SE creation and upgrades.	Download a new license file from the Cloud Console and upload it to License Hub.

 

• Affected components: License Hub and Avi Controller 32.1.x endpoints in air-gapped or offline environments.
• Not affected: NSX Manager, SSP endpoints and License Hub Connected mode.
• Most likely to be affected: customers who imported their current license file into License Hub before October 17, 2026.
• Trigger: The Avi Controller syncs with License Hub every 30 minutes, so affected Controllers have been unlicensed since October 17, 2026.

 

Cause

License files are digitally signed with a certificate. The certificate used to sign older license files expired on October 17, 2026.

License Hub currently checks that certificate against today's date, instead of the date the license was issued. As a result, a license signed before the certificate expired is rejected, even though the license itself is still valid.

Resolution

Replace the license file in License Hub with a newly signed one. This takes a few minutes and does not affect licenses already in use.

1. Sign in to the Cloud Console from a machine with internet access.
2. Regenerate and Download the latest signed license file (license .zip) for your License Hub.
   
   
3. Copy the license file to the disconnected environment using your usual approved transfer method.
4. In License Hub, upload the new license file to replace the existing one.
5. Confirm the upload succeeds, then retry assigning or changing licenses for your Avi endpoints.

Tip: Upload the license file soon after downloading it. A permanent fix is planned in a future release, and this article will be updated when it is available.