The system creates certificates required for the communication between NSX appliances and external communication, including NSX Federation appliances. This topic covers the various certificate information
The Certificates for NSX Manager table reflects certificate details including the span of time that certificates are valid for new deployments only. New certificates are not generated during upgrades, so certificate validity dates will reflect a previous NSX version's default certificate expiration date. To replace existing self-signed certificates with CA-signed certificates, refer to details in Replace Certificates. To read about security compliance events, refer to the NSX Event Catalog.
Certificate Naming Convention | Purpose | Replaceable using service_type | Default Validity |
---|---|---|---|
APH-AR | Appliance Proxy hub (APH) server public key and Asynchronous Replicator for cross communication, for Federation | Yes, use service_type=APH. | 825 days |
APH-TN | Appliance Proxy hub (APH) certificate for Transport node (TN) and intra-cluster communication | Yes, use service_type=APH_TN. | 825 days |
API (aka tomcat) | API server certificate for NSX Manager node | Yes, use service_type=API. | 825 days |
API-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_API. | 100 years |
AR-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_AR. | 100 years |
CCP-Corfu Client | Control Configuration Plane Corfu client certificate | Yes, use service_type=CBM_CCP. | 100 years |
CSM-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_CSM. | 100 years |
CCP | Control Configuration Plane certificate to communicate with transport nodes | Yes, use service_type=CCP. | 10 years |
Cluster (aka mp-cluster) | API Server certificate used by VIP | Yes, use service_type=MGMT_CLUSTER. | 825 days |
Cluster Manager-Corfu | Corfu client certificate | Yes, use service_type=CBM_CLUSTER_MANAGER. | 100 years |
CM Inventory-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_CM_INVENTORY. |
100 years |
Corfu Server | Corfu server certificate | Yes, use service_type=CBM_CORFU. | In 4.1.0, 825 days. Starting in 4.1.1, 100 years. |
GM-Corfu Client | Corfu client certificate present on Global Manager only | Yes, use service_type=CBM_GM. | 100 years |
IDPS reporting-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_IDPS_REPORTING. | 100 years |
Messaging Manager-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_MESSAGING_MANAGER. | 100 years |
Monitoring-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_MONITORING. | 100 years |
MP-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_MP. | 100 years |
Site Manager-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_SITE_MANAGER | 100 years |
Upgrade Coordinator-Corfu Client | Corfu client certificate | Yes, use service_type=CBM_UPGRADE_COORDINATOR. | 100 years |
Certificates for NSX Federation Communication
By default, the Global Manager uses self-signed certificates for communicating with internal components, registered Local Managers, and for authentication for NSX Manager UI or APIs.
You can view the external (UI/API) and inter-site certificates in NSX Manager. The internal certificates are not viewable or editable.
Certificates for Global Managers and Local Managers
After you add a Local Manager into the Global Manager, a trust gets established by exchanging certificates between Local Manager and Global Manager. These certificates also get copied into each of the sites registered with the Global Manager. Starting in NSX 4.1.0, the certificate used to establish trust with the Global Manager gets generated only when the Local Manager registers with the Global Manager. That same certificate gets deleted if the Local Manager moves out of the NSX Federation environment.
See the Certificates for Global Managers and Local Managers table for a list of all the NSX Federation specific certificates created for each appliance and the certificates these appliances exchange with each other:
Naming Convention in the Global Manager or Local Manager | Purpose | Replaceable? | Default Validity |
---|---|---|---|
The following are certificates specific to each NSX Federation appliance. | |||
APH-AR certificate |
|
Yes, use service_type=APH. See Replace Certificates. | 10 years |
GlobalManager |
|
Yes, use service_type=GLOBAL_MANAGER. Refer to Replace Certificates. | 825 days |
Cluster certificate |
|
Yes, use service_type=MGMT_CLUSTER. Refer to Replace Certificates. | 825 days |
API certificate |
|
Yes, use service_type=API. See Replace Certificates. | 825 days |
LocalManager |
|
Yes, use service_type=LOCAL_MANAGER. See Replace Certificates. | 825 days |
The LM and the GM share their Cluster, API, and APH-AR certificates between them. If a certificate is CA-signed, the CA is synchronized, but that certificate is not. |
Principal Identity (PI) Users for NSX Federation
NSX Federation Appliance | PI User Name | PI User Role |
---|---|---|
Global Manager | LocalManagerIdentity One for each Local Manager registered with this Global Manager. |
Auditor |
Local Manager | GlobalManagerIdentity | Enterprise Admin |
LocalManagerIdentity
One for each
Local Manager registered with the same
Global Manager. To get a list of all the
Local Manager PI users because they are not visible in the UI, enter the following API: command
GET https://<local-mgr>/api/v1/trust-management/principal-identities |
Auditor |