Deploying NSX VIBs fails on the ESXi host after changing the vCenter Server certificates

Products

VMware NSX for vSphere

Issue/Introduction

After changing the vCenter Server certificates in a VMware NSX for vSphere 6.2.x environment, , you experience these symptoms:

Deploying the NSX VIBs on the ESXi host fails
The WCP service fails to start on vCenter Server 7.0
Running the show log command on the NSX Manager console reports entries similar to:
```
GMT ERROR taskScheduler-15 InstallTask:190 - error while creating eam agency for deployment com.vmware.vim.binding.eam.fault.NoConnectionToVCenter: inherited from com.vmware.vim.binding.eam.fault.EamRuntimeFault: inherited from com.vmware.vim.binding.eam.fault.NoConnectionToVCenter
```
For more information, see Collecting diagnostic information for VMware NSX for vSphere 6.x (318901).

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX for vSphere 6.2.x

Cause

This issue occurs because the EAM agent fails to log in to the vCenter Server due to new certificates.

Resolution

To resolve this issue, follow the below procedure.

On vCenter Server for Windows:

Connect to vCenter Server through a Console or Remote desktop session.
Open an elevated command prompt.
Create a temporary directory named c:\certificate.

Run this command to retrieve the vpxd-extension solution user certificate and key:

"%VMWARE_CIS_HOME%"\vmafdd\vecs-cli entry getcert --store vpxd-extension --alias vpxd-extension --output c:\certificate\vpxd-extension.crt
"%VMWARE_CIS_HOME%"\vmafdd\vecs-cli entry getkey --store vpxd-extension --alias vpxd-extension --output c:\certificate\vpxd-extension.key

Navigate to C:\Program Files\VMware\vCenter Server\vpxd\scripts:
```
cd C:\Program Files\VMware\vCenter Server\vpxd\scripts
```
Note: The path listed is for a default install of vCenter Server. If you have customized the install location of vCenter Server, change the directory accordingly.

Run this command to update the extension's certificate with vCenter Server:

"%VMWARE_PYTHON_BIN%" updateExtensionCertInVC.py -e com.vmware.vim.eam -c C:\Certificate\vpxd-extension.crt -k C:\Certificate\vpxd-extension.key -s localhost -u [email protected]

Note: If this produces the error "Hostname mismatch, certificate is not valid for 'localhost'", change 'localhost' to the FQDN or IP of the vCenter. The process is checking this value against the SAN entries of the certificate.

Note: The default user and domain is [email protected]. If this was changed during configuration, change the domain to match your environment.

When prompted, enter the [email protected] password.
Navigate to the C:\Program Files\VMware\vCenter Server\bin folder:
```
cd C:\Program Files\VMware\vCenter Server\bin
```
Restart the VMware ESX Manager service with these commands:

For more information on managing service in the vCenter Server Appliance, see Stopping, Starting or Restarting VMware vCenter Server Appliance services(344633).
```
service-control --stop EsxAgentManager
service-control --start EsxAgentManager
```

On the vCenter Server Appliance:

Log in to the vCenter Server Appliance using SSH.
Run this command to enable access the Bash shell:
```
shell.set --enabled true
```
Type shell and press Enter.

Run this command to retrieve the vpxd-extension solution user certificate and key:

mkdir /certificate
/usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store vpxd-extension --alias vpxd-extension --output /certificate/vpxd-extension.crt
/usr/lib/vmware-vmafd/bin/vecs-cli entry getkey --store vpxd-extension --alias vpxd-extension --output /certificate/vpxd-extension.key

Run this command to update the extension's certificate with vCenter Server.

python /usr/lib/vmware-vpx/scripts/updateExtensionCertInVC.py -e com.vmware.vim.eam -c /certificate/vpxd-extension.crt -k /certificate/vpxd-extension.key -s localhost -u [email protected]

Note: If this produces the error "Hostname mismatch, certificate is not valid for 'localhost'", change 'localhost' to the FQDN or IP of the vCenter. The process is checking this value against the SAN entries of the certificate.

Note: The default user and domain is [email protected]. If this was changed during configuration, change the domain to match your environment. When prompted, type in the Administrator@domain.local password.

Restart the VMware ESX Manager service with these commands:

For more information on managing service in the vCenter Server, see Stop, Start or Restart Services on vCenter Server 7.x/8.x(340943).
```
service-control --stop vmware-eam
service-control --start vmware-eam
```