Scripted process to Replace Expired or Self-signed VMware NSX-T Manager Certificates with VMCA-Signed Certificates
search cancel

Scripted process to Replace Expired or Self-signed VMware NSX-T Manager Certificates with VMCA-Signed Certificates

book

Article ID: 317900

calendar_today

Updated On:

Products

VMware Cloud Foundation VMware NSX

Issue/Introduction

The process of generating a Certificate Signing Request (CSR), creating a certificate, importing and deploying the certificate via the VMware Certificate Authority (VMCA) involves a lot of manual work, with making REST API calls.
This KB helps to automate the entire process with a script.

Symptoms:
We have expired certificates or self-signed certificates on the NSX-T Managers and NSX-T VIP.
  • Due to the expired certificates - these cannot be replaced by a management interface like the SDDC Manager - they have to replaced directly on the NSX-T Managers.
  • Due to self-signed certificates - SDDC Manager does not trust the certificate, and therefore needs to be replaced with a VMCA signed certificate.

Environment

VMware NSX-T 3.x 
VMware NSX 4.x

Cause

Expired or Self-Signed certificates on the NSX-T Manager nodes lead to alarms and may impact workflow, such as those with the VCF SDDC Manager.

Resolution

NOTE: The script needs to be run on the vCenter (Compute Manager) registered to the VMware NSX Managers, confirm under: System, Fabric, Compute Managers.

The script will only replace the Manager Node Certificate and Cluster (VIP) certificate, it is not intended to be used for any other certificates.

The script is available to download from this KB.



Script Usage:

To see the syntax and commands available, run python nsxVmcaCert.py


  1. Download the script nsxtVmcaCert.py and copy it to the vCenter connected to the VMware NSX environment. If you encounter trouble copying the script to vCenter, KB 326317 will help enable SCP for root on vCenter, allowing you to copy the script to vCenter.
  2. Run the script with the FQDN of the manager node or the VIP, with the appropriate flags, and supply the password for the admin user:
    1. Command for NSX-T Manager, node certificate replacement, repeat for each manager node in the cluster:
      # python nsxtVmcaCert.py -f <nsxt_manager_fqdn> -m
    2. You will be prompted for the VMware NSX manager admin user's password, enter to proceed.



    3. Command for the Cluster VIP, only need to run against one manager:
      # python nsxtVmcaCert.py -f <nsxt_vip_fqdn> -v


The script needs to be re-run for each VMware NSX Manager and VIP that we need to replace the certificates on.

For example:
If we have 3 VMware NSX Manager nodes VIP is configured, we need to run the script 4 times:

python nsxtVmcaCert.py -f <nsx-manager-node1-fqdn> -m

python nsxtVmcaCert.py -f <nsx-manager-node2-fqdn> -m

python nsxtVmcaCert.py -f <nsx-manager-node3-fqdn> -m

python nsxtVmcaCert.py -f <cluster-vip-fqdn-address> -v

▶

Additional Information

Attachments

nsxtVmcaCert get_app
Powered by Wolken Software