VCF on VxRail: Replace NSX-T Local-Manager Certificate in VCF Environment

Background:

There are different types of NSX-T certificates as described below:
 

Certificate Name	Purpose	Replaceable	Default Validity
Tomcat	This is an API certificate used for external communication with individual NSX Manager nodes through UI or API.	Yes	825 days
mp-cluster	This is an API certificate used for external communication with the NSX Manager cluster using the cluster VIP, through UI or API.	Yes	825 days
LocalManager	This is a platform Principal Identity certificate for the Federation. If you are not using Federation, this certificate is not used.	Yes	825 days

For VCF solutions:

The Tomcat and mp-cluster are replaced with CA certificates signed by VMCA from vCenter. The mp-cluster and Tomcat certificates may still be there but they are not being used.

NSX-T Manager with VCF:

• Tomcat - Node1 > not being used
• mp-cluster - VIP > not being used

Replaced during installation with the below:

• CA - Node1
• CA - VIP

If you want to check if the certificate is being used, run the following API on the Postman platform:

GET https://<nsx-mgr>/api/v1/trust-management/certificates/<certificate-id>

Local-manager certificate is the Principal Identity certificate used to communicate with other sites in the Federation.

An NSX-T Federation environment contains an active and a standby Global Manager cluster and one or more Local Manager clusters.
 

How to ascertain the number of Local Manager Clusters:

To check the environment and find out how many Local Manager Clusters there are, follow the below steps and screenshot:

From System > Configuration > Location Manager:

• At the top of the Local Manager, it shows you which cluster you are logged in on. In this example, we are logged in to a Local Manager Cluster.
• In the middle of the page, it shows the Global Manager Clusters, and which cluster is Active, and which is Standby.
• Other Local Manager Clusters are seen at the bottom under Remote Sites.

Procedure to replace local-manager self-signed certificates:

1. Log in to NSX Manager in the Local Manager Cluster.
2. Collect an NSX-T backup before proceeding. This step is important!
   1. System > Lifecycle Management > Backup and Restore > Start Backup

3. Check the certificates and expiry date.
   1. Click System > Settings > Certificates

There is one certificate per Local Manager cluster regardless of the number of NSX Managers there are within the cluster.

1. Log in to any NSX Manager on Local Manager cluster 1.
2. Generate a new CSR.
   1. Click System > Settings > Certificates > CSRs > Generate CSR

2. Enter the Common Name as local-manager.
3. Enter the Name as LocalManager.
4. The rest is user business and location details (This can be copied from an old expiring certificate.)
5. Click Save.

3. Create a Self-Signed Certificate using the Generated CSR.
   1. Click the New CSR check box > Generate CSR > Self-Sign Certificate for CSR.

2. Ensure that the Service Certificate is set to No and click Save.
3. Return to the Certificates tab, locate the New Certificate and Copy Certificate ID.

4. Replace the Principal Identity certificate for the Local Manager.
   1. User to install the Postman platform.
   2. In the Authorization tab, select Type > Basic Auth.
   3. Enter NSX-T Manager login details.

4. In the Headers tab, change "application/xml" to "application/json."

5. In the Body tab, select the POST API command.
   1. Select Raw and then select JSON.
   2. In the box beside POST, enter URL https://<nsx-mgr-IP-local-manager-clusterX>/api/v1/trust-management/certificates?action=set_pi_certificate_for_federation
   3. In the above, the URL is the IP used for any NSX manager within a specific Local Manager Cluster.
   4. In the body section, enter the below in two lines as seen in the screenshot:

{ "cert_id": "<certificate id, copied from step 3>",
"service_type": "LOCAL_MANAGER" }

6. Click Send and ensure that you see the result 200 OK.

5. Repeat Steps 1 through 4 on each Local Manager Cluster 2 and 3.

Once these steps are complete, you have created one new certificate on each Local Manager Cluster and replaced the Principal Identity Certificate on each Local Manager Cluster.

It is now time to delete the old expiring certificates from each of the three Local Manager Clusters.

1. Check that the certificate is no longer in use.
   1. Copy Certificate ID
   2. Open Postman
   3. Select GET API instead of POST.
   4. Enter URL https://<nsx-mgr-IP-local-manager-clusterX>/api/v1/trust-management/certificates/<certificate-id>
   5. Look for "used_by" and confirm it has empty brackets.

    "used_by" : [ ],
    "resource_type" : "certificate_self_signed",
    "id" : "9cd133ca-32fc-48a2-898b-7acd928512a5",
    "display_name" : "local-manager",
    "description" : "",
    "tags" : [ ],
    "_create_user" : "admin",
    "_create_time" : 1677468138846,
    "_last_modified_user" : "admin",
    "_last_modified_time" : 1677468138846,
    "_system_owned" : false,
    "_protection" : "NOT_PROTECTED",
    "_revision" : 0
  }

2. Go to System > Settings > Certificates and select the required certificate.

3. Click Delete > Delete.

4. Confirm that Principal Identity is working and using the new certificates:
   1. Open Postman
   2. Select GET.
   3. Run URL https://<nsx-mgr-IP-local-manager-clusterX>/api/v1/trust-management/principal-identitie.
   4. Output should be similar to the below, "certificate_id" should show the newly created certificate ID.

Replacing Global-manager certificates:

To replace the Global Manager Certificate, follow the same process but change "LOCAL_MANAGER" to "GLOBAL_MANAGER" and perform the procedure from the Global Manager Cluster.

Other related articles:

See these related Broadcom VMware articles for more information:

• Types of Certificates 
• Configuring the Global Manager and Local Managers
• Replace Certificates on Version 3.2  
• Replace Certificates on Version 3.1
• Create a Certificate Signing Request File 
• How to renew the NSX-t-superuser-certificate used by Principal Identity user

VxRail G410, VxRail G Series Nodes, VxRail E560 VCF, VxRail E560F, VxRail E560F VCF, VxRail E560N, VxRail E560N VCF, VxRail E660, VxRail E660F, VxRail E660N, VxRail E665, VxRail E665F, VxRail E665N, VxRail G560, VxRail G560 VCF, VxRail G560F , VxRail G560F VCF, VxRail Gen2 Hardware, VxRail P Series Nodes, VxRail P470, VxRail P570, VxRail P570 VCF, VxRail P570F, VxRail P570F VCF, VxRail P580N, VxRail P580N VCF, VXRAIL P670F, VxRail P670N, VxRail P675F, VxRail P675N, VxRail S Series Nodes, VxRail S470, VxRail S570, VxRail S570 VCF, VxRail S670, VxRail Software, VxRail V Series Nodes, VxRail V470, VxRail V570, VxRail V570 VCF, VxRail V570F, VxRail V570F VCF, VXRAIL V670F, VxRail VD-4000R, VxRail VD-4000W, VxRail VD-4000Z, VxRail VD-4510C, VxRail VD-4520C, VxRail VD Series Nodes ... View More View Less