topic Re: NSX-T 3.1 renew self signed certificates in VMware NSX Discussions

NSX-T 3.1 renew self signed certificates

Petersaints — Sun, 27 Nov 2022 13:44:31 GMT

Hello all,

Need to renew the NSX-T certificates. I will use self signed ones. I have a cluster with 3 managers.

I notice that the actual certificates of mp-cluster and the tomcat certificate for node 1, are issued to the hostname of manager one, and not to the fqdn. For node2 and node 3 the certificates are issued for the fqdns.

My question is:

When i generate new certificates, in this case for node1 and mp-cluster, should i use the fqdn, or only the hostname?

Thanks.

Regards.

Re: NSX-T 3.1 renew self signed certificates

engyak — Sun, 27 Nov 2022 18:14:46 GMT

If you can, issue a certificate to the FQDN of the vIP and add the individual host names as Subject Alternative Names (SANs) along with the vIP ID. You should have 4 total SANs, unless you have the ability to also add the IP address (then it should be

This will allow your NSX managers to authenticate either when addressed individually or as a cluster member.

Re: NSX-T 3.1 renew self signed certificates

salarmehdizadeh — Wed, 01 Feb 2023 08:01:58 GMT

Hello,

1. Can we extend the duration of an expired certificate?
2. You advised entering SAN (VIP and three manager nodes with FQDN) for a certificate, but in the CSR generating process we only can enter the Common name, there is no section for entering SAN?