Logging in to the Supervisor cluster fails because of a Certificate error.

Problem

Tanzu Kubernetes Grid deployment fails when the Supervisor cluster log-in fails with the following error message.

{"function":"LoginToWCPCluster","level":"info","msg":"Failed to login to WCP cluster. Error was: time=\"2024-04-13T16:19:47Z\" level=error msg=\"Error occurred during HTTP request: Get \\\"https://10.40.67.17/wcp/loginbanner\\\": x509: certificate signed by unknown authority (possibly because of \\\"crypto/rsa: verification error\\\" while trying to verify candidate authority certificate \\\"CA\\\")\"\ntime=\"2024-04-13T16:19:47Z\" level=fatal msg=\"Error while connecting to host 10.40.67.17: Get \\\"https://10.40.67.17/wcp/loginbanner\\\": x509: certificate signed by unknown authority (possibly because of \\\"crypto/rsa: verification error\\\" while trying to verify candidate authority certificate \\\"CA\\\").\"\n","time":"2024-04-13T16:19:47Z"}

Cause

After configuring VMware vCenter, in the NSX Application Platform Automation Appliance deployment wizard, the user changed the VMware vCenter IP address and installed a new certificate, but the existing certificate was also retained. As a result, NSX Application Platform Automation Appliance did not import the new certificate because a certificate was present on VMware vCenter.

When Tanzu Kubernetes Grid is redeployed, the existing certificate is used instead of the new one, which causes the deployment error.

Solution

  1. SSH into the NSX Application Platform Automation Appliance.
  2. Delete the existing certificate.
    rm -f /opt/napp/certs/*
  3. In the NSX Application Platform Automation Appliance deployment wizard, navigate to Environment Configuration.
  4. In the Configure the destination vCenter Server for TKG installation, click Edit Connection.

    NSX Application Platform Automation Appliance reconnects to VMware vCenter and retrieves the latest certificate.