⚡
Before this can be done please complete Use Postman to perform API requests on NSX

⚡
Before this can be done please complete Signing the NSX CSR with a Microsoft (root) CA Server.

In this lab I am working with the following software and versions:

Software	Version	Filename
VMware NSX	4.0.0.1	nsx-unified-appliance-4.0.0.1.0.20159694.ova
Postman	v9.29.0	Postman-win64-Setup.exe

By default when you deploy the NSX Manager Nodes the Nodes will have self-signed certificates. In an enterprise environment they typically have their own public key infrastructure (PKI).

Replace all the self-signed SSL certificates with one CA-signed (wildcard) certificate.

Do this for all NSX Manager Nodes and the NSX Manager VIP address.

The Steps

STEP 1: Import the root CA certificate
STEP 2: Import the CA-signed certificate
STEP 3: Activate/Assign/Replace the CA-signed certificate

Link to API guide for NSX-T

STEP 1» Import the root CA certificate

When I prepared the Microsoft CA I exported the root certificate here Configuring a Microsoft Server to be a Root Certificate Authority (CA) in Step 2.

I need to import this root certificate into the NSX Manager Nodes.

Go to System → Settings → Certificates → Import → CA Certificate.

Open the root certificate file in a notepad and copy the content over in the “Certificate Contents” field.

Verify if the root certificate is imported correctly.

STEP 2» Import the CA-signed certificate

Create a full chain with the CA-signed NSX certificate content first and then at the end the CA root certificate

—–BEGIN CERTIFICATE—–
NSX-T FQDN Node Certificate
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—–
CA Root Certificate
—–END CERTIFICATE—–

My root certificate:

My signed NSX Manager certificate:

My full chain (signed + root):

I need to import this signed (full chain) certificate into the NSX Manager Nodes with the private key that was generated when I created the CSR).

Go to System → Settings → Certificates → Import → Certificate.

My Private Key (from when I created the CSR)

Open the signed certificate file and the root certificate in a notepad create one single output (based on the order provided above) and copy/paste the content over in the “Certificate Contents” field.

Also open the private key file in a notepad and copy/paste the content over in the “Private key” field.

Verify if the signed certificate is imported correctly.

Make note of the certificate ID (that I will use in the API requests to assign (replace) the existing certificates):

b9ace4da-9d9a-4d55-800c-fc7fdf294f28

STEP 3» Activate and Assign and Replace the CA-signed certificate

Before I start it is good to look at the starting point.

When I access all the NSX Manager Nodes using the FQDN the browser provides a “Not secure” message in front of the URL.

The certificate ID:

3eb60477-d00d-45a5-a783-80660d6d0d44

All the commands below are done with API requests performed using postman. The API request information was retrieved from the NSX API Guide.

⚡
Before this can be done please complete Use Postman to perform API requests on NSX.

Verify if the certificate is available and valid for usage

GET https://<nsx-mgr>/api/v1/trust-management/certificates/<certificate-id>?action=validate

GET https://{{hostname-vip}}/api/v1/trust-management/certificates/b9ace4da-9d9a-4d55-800c-fc7fdf294f28?action=validate

Activate and Assign and Replace the NSX Node certificates

NSX Local Manager Node 1

POST https://<nsx-mgr>/api/v1/node/services/http?action=apply_certificate&certificate_id=3eb60477-d00d-45a5-a783-80660d6d0d4

POST https://{{hostname-lm1}}/api/v1/node/services/http?action=apply_certificate&certificate_id=b9ace4da-9d9a-4d55-800c-fc7fdf294f28

The output of Postman after I executed the API request.

NSX Local Manager Node 2

POST https://{{hostname-lm2}}/api/v1/node/services/http?action=apply_certificate&certificate_id=b9ace4da-9d9a-4d55-800c-fc7fdf294f28

The output of Postman after I executed the API request.

NSX Local Manager Node 3

POST https://{{hostname-lm3}}/api/v1/node/services/http?action=apply_certificate&certificate_id=b9ace4da-9d9a-4d55-800c-fc7fdf294f28

The output of Postman after I executed the API request.

Activate and Assign and Replace the NSX VIP certificate

POST https://<nsx-mgr>/api/v1/cluster/api-certificate?action=set_cluster_certificate&certificate_id=d60c6a07-6e59-4873-8edb-339bf75711ac

POST https://{{hostname-vip}}/api/v1/cluster/api-certificate?action=set_cluster_certificate&certificate_id=b9ace4da-9d9a-4d55-800c-fc7fdf294f28

The output of Postman after I executed the API request.

When I access all the NSX Manager Nodes now using the FQDN the browser provides a lock sign in front of the URL and the “Not secure” message is disappeared.

I are using valid certificates now.

Lab: Replacing the self-signed SSL certificates with CA-signed certificates

The Steps

STEP 1» Import the root CA certificate

STEP 2» Import the CA-signed certificate

STEP 3» Activate and Assign and Replace the CA-signed certificate

Verify if the certificate is available and valid for usage

Activate and Assign and Replace the NSX Node certificates

NSX Local Manager Node 1

NSX Local Manager Node 2

NSX Local Manager Node 3

Activate and Assign and Replace the NSX VIP certificate