After the vCenter Server certificate is replaced, the compute manager connection is "Down" in the NSX UI

Products

• VMware NSX

Issue/Introduction

• Unable to successfully have NSX configured on new ESXi hosts and the process will fail with an error message stating
  
  Error: There was an unexpected error occurred while fetching Physical NICs for the host. Please manually enter nic to proceed. (Error code: #####)"
  
  
• Certificates have been replaced on vCenter
• On the NSX UI, System > Fabric > Compute Manager, Connection Status is 'Down', clicking on 'Down' shows the error
  
  Compute Manager <Compute Manager Host Name> cannot be connected, as its thumbprint does not match. Please edit compute manager details if thumbprint is changed.
​​
or on NSX 9.x

Unable to connect to the compute manager as its trusted root certificate cannot be found. Validate the certificate chain in vCenter and then re-register the compute manager by editing it​


• In versions earlier than NSX 9.x, the log /var/log/cm-inventory/cm-inventory.log shows entries similar to this example:
  

  <date> INFO inventoryTasksScheduler4 CmInventoryService 7538 FABRIC [nsx@6876 comp="nsx-manager" level="INFO" subcomp="cm-inventory"] Retrieved cm config info from cm plugin instance, cmPluginStatusData= CmPluginStatusData{id=<id>, server=<name/IP>, cmPluginStatus=CmPluginStatusInfo{status=FAILED, cmConnectionStatus=DOWN, errors=[{"moduleName":"cm-inventory","errorCode":40107,"errorMessage":"Unable to connect to Compute Manager <name/IP>. Please edit compute manager details if FQDN or thumbprint is changed. If the issue persists, please check whether the https port 443 and http port 80 are open in the firewall on all NSX nodes."}, {"moduleName":"cm-inventory","errorCode":40118,"errorMessage":"Compute Manager <name/IP> can not be connected, as its thumbprint does not match. Please edit compute manager details if thumbprint is changed."}]}}

<date> INFO inventoryTasksScheduler6 CmPluginStateManager ##### SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="cm-inventory"] Cm Plugin info found for cm ########-####-####-####-###########. Plugin Info:ComputeManagerPluginInfo{id='########-####-####-####-###########', server=<name/IP>, name='null', description='null', originType='vCenter', version='#.#.#', cmPluginStatus='ComputeManagerPluginStatus{cmId='########-####-####-####-###########', originType='vCenter', cmConnectionStatus='DOWN', cmConnectionStatusDetails='null', pluginStatus='FAILED', errors='[{"moduleName":"cm-inventory","errorCode":40107,"errorMessage":"Unable to connect to Compute Manager <name/IP>. Please edit compute manager details if FQDN or thumbprint is changed. Please check if compute manager certificate is valid and not revoked. If the issue persists, please check whether the https port 443 and http port 80 are open in the firewall on all NSX nodes."}, {"moduleName":"cm-inventory","errorCode":40118,"errorMessage":"Compute Manager <name/IP> cannot be connected, as its thumbprint does not match. Please edit compute manager details if thumbprint is changed."}]', warnings='[]'}', additionalInfo='[]'} . Plugin Status : FAILED

Environment

VMware NSX

Cause

This problem occurs because the thumbprint of the certificate that NSX Manager holds is different from the updated thumbprint.
The thumbprint of the certificate will change only when the certificate itself is replaced.
This may be from  following the replacement of the vCenter Server certificate using vCert - expired certificate replacement script

Resolution

To restore the Compute Manager connection:

1. Navigate to System > Fabric > Compute Manager
2. Select Compute Manager and Edit
3. Click on Save
4. The "Thumbprint is missing" warning popup will be displayed if the provided thumbprint is incorrect
5. Validate the presented thumbprint in the popup window and Add
   
   To check the thumbprint in the vCenter Server Appliance Shell, run the following command:

echo | openssl s_client -connect localhost:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256

Fingerprint=##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##

Additional Information

If "HTTPS port of Reverse Proxy" is 0, you can not update the compute manager settings due to the issue noted in "Field level validation errors: {value 0 of property reverse_proxy_https_port has violated the minimum valid value 1}" when editing compute manager in NSX.