How to renew Self-Signed certificates for NSX-T LocalManager, tomcat and mp-cluster.

-

 Hello Everyone,

Hope you are doing well.

Today, i am covering this posts regarding the self-signed certificate expires in NSX-T environments for components like LocalManager and mp-cluster. 

you will see warnings on NSX-T GUI that LocalManager and mp-cluster self-signed certificates has been expired. 

Generally, we update only NSX Manager Cluster/VIP certificates only. 

Certificates for LocalManager, tomcat and mp-cluster comes with self-signed certificates when we deployed the NSX-T environment.

tomcat certificates is an API certificate used for external communication with individual NSX Manager nodes through UI/API.

mp-cluster is an API certificate used for external communication with the NSX Manager cluster using the cluster VIP, through UI/API.




Let's start to renew the LocalManager self-signed certificates.

Login to NSX-T GUI with admin credentials.

Go to Systems > Under Settings click on Certificates > click on CSRs > click GENERATE CsR





Click on GENERATE. CSR for LocalManager certificates will generate and shows as below.



Now, select the LocalManager CSR and go to Actions and click on Self Sign Certificate for CSR.




Once you click on Self Sign Certificate for CSR, it will ask for number of days the certificate will be active, by default is 825 days but we can modify the number of days according to our policy.



Click on ADD. Certificate will be generated and you can see in Certificates Tab like below.




Now, you can delete the existing expired local-manager certificate and certificate alarm will be resolved in NSX-T GUI.


If you will get error while deleting the expired certificates like "Certificate cannot be deleted because it is used by 1 MP node(s)" then you need to use the NSX-T API to find the node which is using this expired certificates and then release the certificates from that node and then you will be able to delete the certificate successfully.

Hope, this will be informative. thanks !!


Comments

Post a Comment

Popular posts from this blog

How to migrate the N-VDS as the host switch to VDS 7.0 in NSX-T 3.x

-
Image
  Hello There, In this article, i am covering how to migrate the ESXi host switch from N-VDS to VDS 7.0 switch in NSX-T 3.2.x version. When using N-VDS as the host switch,  NSX-T  is represented as an opaque network in  vCenter Server . N-VDS owns one or more of the physical interfaces (pNICs) on the transport node, and port configuration is performed from  NSX-T Data Center . You can migrate your host switch to  vSphere  Distributed Switch (VDS) 7.0 for optimal pNIC usage and manage the networking for  NSX-T  hosts from  vCenter Server . When running  NSX-T  on a VDS switch, a segment is represented as an  NSX-T  Distributed Virtual Port Groups. Any changes to the segments on the  NSX-T  network are synchronized in  vCenter Server. We have an NSX-T environment running with NSX-T 3.2.2.1 version. this environment was designed and implemented with NSX-T 2.x version and that time we used the N-VDS as host...
Read more

vROPS appliances password remediation tasks failed from SDDC manager

-
Image
Issue details:-   Password remediation tasks on SDDC manager getting failed with below error. However, we are able to connect SSH with root password on the vROPS appliances, no issues with credentials. I checked Operations logs on SDDC manager and found below logs, indicating the SSH connectivity issues from SDDC to vROPS appliances. Tried to do SSH vROPS appliance from SDDC manager, getting below error... Seems some issue with ECDSA key.. Resolution:- SSH to vROPS appliance and retrieve the ECDSA ssh keys as below. Now, we have 2 options to update the correct SSH keys for vROPS appliance on SDDC manager known_Hosts files located at below location.   /root/.ssh/known_hosts   /etc/vmware/vcf/commonsvcs/known_hosts   /home/vcf/.ssh/known_hosts   /opt/vmware/vcf/commonsvcs/defaults/hosts/known_hosts First option is manually copy and paste the SSH key on all the known_hosts files and restart the SDDC manager services and then try to remediate the password again...
Read more

How to Import/Register a VM into vRA portal

-
Image
You can import an unmanaged virtual machine to a vRealize Automation environment. An unmanaged virtual machine exists in a vCenter but is not managed in a vRealize Automation environment and cannot be viewed in the vRA portal . Once you import an unmanaged virtual machine, the virtual machine is managed by using the vRealize Automation management interface. you can see the virtual machine on the Managed Machines tab or the Items tab. Please follow below steps to Import/Register VM into a vRA portal. Log in to vRealize Automation as a fabric administrator and as a business group manager. If you are importing virtual machines that use static IP addresses, prepare a properly configured address pool.  If you use bulk import to import a virtual machine with a static IP address that is allocated to another virtual machine, the import fails. Create a Blueprint and should not have even network attached as well. See below snapin. Create Network profile that s...
Read more