How to replace each internal Corfu certificate in NSX — AR, CCP, CSM, GM, MP, Cluster Manager, IDPS Reporting, Monitoring, and the Corfu API.
NSX stores its internal certificates in the Corfu database, and each service — AR, CCP, CSM, GM, MP, Cluster Manager, IDPS Reporting, Monitoring, and the Corfu API itself — has its own certificate that expires on its own schedule. When one goes, the symptoms are rarely obvious.
Each guide below replaces one specific certificate via the NSX API, with the exact API calls and verification steps. The procedure is similar across services, but the certificate names and service IDs differ — pick the guide for the certificate that’s expiring in your environment.
Replacing the idps reporting Corfu certificate in NSX
In this blog we will go over replacing the idps reporting Corfu certificate in NSX Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.
Identifying the Expired Certificate In my case the cluster manager Corfu certificate has already expired
Generating a New Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate
...
Replacing the cluster manager Corfu certificate in NSX
In this blog we will go over replacing the cluster manager Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.
In my case the cluster manager Corfu certificate has already expired
Generating a Self Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate
...
Replacing the Monitoring Corfu certificate in NSX
In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.
In my case the Monitoring Corfu certificate has already expired
Generating a Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate
...
Replacing the CSM Corfu certificate in NSX
In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. I covered the same procedure for the MP Corfu certificate and the CCP Corfu certificate in separate posts.
The Expired CSM Corfu Certificate In my case the CSM Corfu certificate has already expired
...
Replacing the GM Corfu certificate in NSX
This walkthrough covers a targeted replacement of a node-scoped Global Manager (GM) Corfu certificate. The screenshots were captured on NSX 4.1.0.2; the exact UI differs in later releases.
Version and safety note: On NSX 4.2.x and VCF NSX 9.x, Broadcom prefers the built-in NSX Manager certificate-replacement UI. For a broader self-signed-certificate assessment or recovery, use the current Certificate Analyzer, Results and Recovery (CARR) procedure. CARR requires a dry run before remediation. Use the API below only when a targeted GM Corfu binding is appropriate for the installed release.
...
Replacing the MP Corfu certificate in NSX
In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.
In my case the MP Corfu certificate has already expired
Generating a New Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate
...
Replacing the CCP Corfu certificate in NSX
In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.
In my case the CCP Corfu certificate has already expired
Generating a Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate
...
Replacing the AR Corfu certificate in NSX
In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.
Identifying the Expired AR Corfu Certificate In my case the AR Corfu certificate has already expired
Generating a Self-Signed Certificate in the NSX UI In the top menu bar I went to Generate -> Generate Self Signed Certificate
...
Replacing the Corfu API certificate in NSX
In this blog we will go over replacing the Corfu API certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.
Identifying the Expired Corfu Certificate In my case the Corfu API certificate has already expired
Generating a New Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate
...
