In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. I covered the same procedure for the MP Corfu certificate and the CCP Corfu certificate in separate posts. The Expired CSM Corfu Certificate In my case the CSM Corfu certificate has already expired ...
This walkthrough covers a targeted replacement of a node-scoped Global Manager (GM) Corfu certificate. The screenshots were captured on NSX 4.1.0.2; the exact UI differs in later releases. Version and safety note: On NSX 4.2.x and VCF NSX 9.x, Broadcom prefers the built-in NSX Manager certificate-replacement UI. For a broader self-signed-certificate assessment or recovery, use the current Certificate Analyzer, Results and Recovery (CARR) procedure. CARR requires a dry run before remediation. Use the API below only when a targeted GM Corfu binding is appropriate for the installed release. ...
In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. In my case the MP Corfu certificate has already expired Generating a New Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate ...
In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. In my case the CCP Corfu certificate has already expired Generating a Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate ...
In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. Identifying the Expired AR Corfu Certificate In my case the AR Corfu certificate has already expired Generating a Self-Signed Certificate in the NSX UI In the top menu bar I went to Generate -> Generate Self Signed Certificate ...
I was recently trying to replace some service certificates and I accidentally associated the certificate with the wrong service. When trying to delete the certificate I was presented with an error “Certificate delete failed: Certificate cannot be deleted because it is used by 1 MP node” The first step I did was try to figure out what service is associated with the certificate. For that I leveraged the instructions in KB 75277. Performing a GET /api/v1/trust-management/certificates/{cert-id} I was able to identify that CBM_API service was using the certificate. ...
In this blog we will go over replacing the Corfu API certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. Identifying the Expired Corfu Certificate In my case the Corfu API certificate has already expired Generating a New Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate ...
In this blog we will go over replacing the LocalManager certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. Reviewing the Expired Certificate In my case the LocalManager certificate has already expired Generating a Self Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate ...
Important correction (August 25, 2026): The original article incorrectly implied that the NSX Edge Removal Tool preserves attached dependencies and that dependencies could be addressed after removal. Broadcom’s current instructions require administrators to remove or disconnect added services, interfaces, segments, and other dependencies before running the cleaner. The tool must not be used for an Edge cluster serving Workload Control Plane (WCP). The old direct-download link, version-specific filename, executable command, and post-removal dependency workflow have been removed so they cannot be mistaken for current instructions. ...
With the release of of VCF 5 I wanted to get my lab upgraded. The release blog can be found here and the release notes are here Please note that some of the components within the VCF will still need additional upgrading. Please read the release notes for additional details. Downloading the VCF 5.0 Bundles We can start by going to Inventory -> Workload Domains -> Select the domain -> Update/Patches -> Select the VCF version -> Download now. If you do not see the newest releases go to Administration -> Online Depot and add a VMware Customer Connect account that has access to perform downloads. ...