After the initial deployment of NSX-T manger it by default comes with self-signed certificates. It is highly recommended to replace these certificates with your internal certificate authority. You can either use individual certificates for nodes and cluster VIP or can have a single certificate with all FQDN as Subject Alternative Names (SAN)
Create CSR and Sign with CA
Create certificate signing requests for the Fully Qualified Domain Names of you NSX Manager Nodes and Cluster and sign with you Organization Internal Certificate Authority. In my Lab environment I am having single NSX Manager node and Cluster VIP.
Note: – The server certificate must contain the Basic Constraints extension
basicConstraints = cA:FALSE
Import Certificates and Verify
Once the signed certificates are downloaded from CA import that in NSX Manager.
Click on System – Certificates
Click on Import – CA certificates to import you Certificate Authority root certificate.
Make sure that when this certificate was imported, the option Service Certificate was set to No.
Note: – The certificate chain must be in the industry standard order of ‘certificate – intermediate – root, else certificate verification and replacement will fail.
Click on Import – Certificates to import your individual NSX Manager nodes and Cluster VIP certificates.
Once you import all your certificates you can see the list of certificates imported in NSX Manager with respective certificate ID.
To Verify that the certificate is valid by making the following API call, using Postman for API call.
Note: – API calls may vary depends on the NSX-T versions, I am running my NSX-T version 3.1.1. please make sure to refer the Vmware NSX-T respective version document for more details.
To replace the certificate of a manager node, use the API call:
To replace the certificate of the manager cluster VIP, use the
Once certificates are replaced you can browse the NSX-T manager Web UI without any SSL error.
If you have any comments, please drop me a line.
Be First to Comment