How to change Certificate on Nutanix Prism

Learn how to manually replace an SSL/TLS certificate on Nutanix Prism Central or Prism Element, upload the key and chain, handle cluster scope, and verify.

Prism Central and Prism Element expose their management UI/API through a cluster certificate. Replacing it is a Prism certificate-management operation, not a manual file copy to one Controller VM.

Before you begin

Identify whether the endpoint is Prism Central or Prism Element, the cluster virtual IP/FQDN, current AOS/PC version, key type, and connected integrations that pin the old certificate. Take a Prism-supported backup and verify cluster health. Prepare a PEM leaf, matching unencrypted private key, and CA chain as the version's UI requests.

Step-by-step certificate replacement

Sign in to Prism with cluster-administrator privileges and open Settings > SSL Certificate or the version-equivalent certificate-management page.
Choose the replace/import action. Upload the server certificate, private key, and CA chain in their respective fields. Preserve leaf/intermediate order and select the actual RSA/EC key type when the release requests it.
Confirm the replacement and wait for Prism to apply it across the endpoint. Do not restart individual CVMs or overwrite their certificate files manually.
For multiple independent Prism Element clusters and Prism Central, repeat the operation on every management endpoint that presents the certificate.

Older/current releases may expose the supported NCLI equivalent:
```
ncli ssl-certificate import certificate-path=<leaf.pem> `
  key-path=<private.key> cacertificate-path=<chain.pem> key-type=<key-type>
```
Confirm syntax against the installed AOS version before running it.

Product-specific considerations

The virtual IP and DNS name used by administrators and API clients must be in SANs. Prism Central and each Prism Element are separate certificate scopes. Key-type strings and supported algorithms vary by AOS/PC version, so use the version-matched Prism documentation rather than forcing a generic value.

Verify the new certificate

Reconnect to the Prism UI and v3 API by FQDN, inspect the certificate/chain, and check cluster health. Re-test backup, monitoring, automation, and hypervisor integrations that trust or pin Prism.

Rollback

Use the same Prism certificate-management operation to reimport the saved old certificate, key, and chain. If Prism becomes unavailable, use Nutanix's supported recovery procedure rather than modifying CVMs independently.

Common problems

FQDN/VIP missing from SANs.
Leaf and key do not match or key-type selection is wrong.
Chain file is incomplete.
Prism Central is changed but Prism Element endpoints are assumed to inherit it.

Automating certificate replacement with aethercert

The aethercert Nutanix Prism target imports the certificate, CA chain, and private key through Prism's certificate-management API and derives the key type from the issued key.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.