Renewing NSX-T Local certificates - REV

Option 2: Renewing Certificates Using the NSX Manager CLI

1. Log in to NSX Manager via SSH:

   • Log in to your NSX Manager via SSH as the admin user.
   • Use an SSH client to access the system:
     ssh admin@<NSX-Manager-IP>

2. Check Existing Certificates:

   • You can view the current certificate details by running the following command:
     arduino

     get certificate
   • This command will list all the certificates in use, including expiry dates.

3. Generate a New CSR (If Using a CA-Signed Certificate):

   • If you want to renew the certificate using a CA-signed certificate, you need to generate a CSR. This is typically done using the following command:
     php

     certificate csr <certificate-name>
     • Replace <certificate-name> with the specific certificate you want to renew (e.g., NSX-Manager).
     • The system will generate a CSR file and private key for submission to a Certificate Authority (CA).

4. Upload the Signed Certificate (If Using a CA-Signed Certificate):

   • After receiving the signed certificate from the CA, you will need to upload it to NSX-T. Use the following CLI command:
     certificate import <certificate-name> <path-to-signed-cert-file>
   • Replace <certificate-name> with the specific certificate you are renewing and <path-to-signed-cert-file> with the file path to the signed certificate you received.

5. Renew Using Self-Signed Certificate:

   • If you are using a self-signed certificate, you can directly renew it with the following command:
     certificate renew <certificate-name>
   • Replace <certificate-name> with the name of the certificate you wish to renew (e.g., NSX-Manager, NSX-Edge, etc.).

6. Verify the New Certificate:

   • After renewal, verify that the new certificate is applied by running the command:
     get certificate

7. Restart NSX-T Components (If Required):

   • After renewing the certificates, you may need to restart the relevant NSX components (NSX Manager, NSX Edge, NSX Controllers) for the changes to take effect:
     • To restart NSX Manager, use:
       system restart nsx-manager
     • To restart NSX Edge, use:
       system restart nsx-edge

Option 3: Renewing Certificates Using the NSX-T API

For more advanced automation or bulk renewal scenarios, you can use the NSX-T REST API to interact with certificates programmatically.

1. Authenticate with the NSX Manager API:

   • Use an API client like Postman or curl to authenticate with the NSX Manager API:
     curl -u admin:<password> -k https://<NSX-Manager-IP>/api/v1

2. Generate a CSR (Certificate Signing Request):

   • To generate a CSR, make a POST request to the /api/v1/certificates/csr endpoint.

3. Upload the Signed Certificate:

   • Once you have the signed certificate from the CA, upload it using the /api/v1/certificates/importendpoint.

4. Verify the Certificate Renewal:

   • You can retrieve the status of the certificate renewal using the /api/v1/certificates endpoint.

Verifying the Renewal

After renewing the certificates, ensure the following:

1. Correct Certificate is Applied: Use the NSX Manager UI, CLI, or API to verify the certificate’s details and check the expiry date.
2. Check System Health: Ensure there are no errors related to certificate validity or communication failures between NSX components.
3. Network Traffic: Verify that secure communication (via SSL/TLS) between NSX Manager, Edge appliances, and controllers is working correctly.

Conclusion

Renewing NSX-T local certificates is crucial to maintaining the security and integrity of your NSX environment. Whether you’re using self-signed certificates or CA-signed certificates, the process involves generating a new certificate (either manually or automatically), uploading the signed certificate, and ensuring all NSX components (Manager, Edge, Controllers) are correctly configured. Always ensure that you take necessary backups, verify your configuration, and restart components as required after renewing certificates.