"The TN certificate ... failed validation: The certificate has expired" upgrade precheck fails however no TN cert is expired

Products

• VMware NSX

Issue/Introduction

• Following precheck error is triggered:
  • 
• The Certificate Analyzer, Results and Recovery (CARR) Script does not display any expired certificates for Transport Nodes:
  • 
• When running the curl command no node id is returned  curl -k -X GET -H 'X-Nsx-Username:admin' "http://localhost:4321/nsxapi/api/v1/messaging/clients/distribution"

   {   
        "client_ids": [
          "[cvn-edge]:########-####-####-############",
          "[cvn-hv]:########-####-####-############",
          "[cvn-mp-mpa]:########-####-####-############"
        ],  
        "node_id": "########-####-####-############"
      },  
      {   
        "client_ids": [
          "[cvn-hv]:########-####-####-############",
          "[cvn-hv]:########-####-####-############"
        ],  
        "node_id": "00000000-0000-0000-0000-000000000000". <---- No node_id
      }    
    ]   
  }


Environment

VMware NSX

Cause

The Transports nodes have been failed to be removed from the messaging client's list.

Resolution

This is a known issue impacting VMware NSX.

Workaround: 
Ensure that you have a recent, valid backup of NSX managers.

• For the Client_ids that are reporting no node_id, these  can deleted nodes manually from messaging clients by executing below command:
          curl -k -X DELETE -H 'X-Nsx-Username:admin' http://localhost:4321/nsxapi/api/v1/messaging/clients/########-####-####-############
• Confirm that these Client_ids have been removed by checking the below output 
          curl -k -X GET -H 'X-Nsx-Username:admin' http://localhost:4321/nsxapi/api/v1/messaging/clients