https://docs.vmware.com/en/VMware-Validated-Design/5.0.1/com.vmware.vvd.sddc-nsxt-domain- deploy.doc/GUID-B7019BCE-4FA1-40BB-8DC2-EE47967A47F1.html You can replace the certificate for a manager node or the manager cluster virtual IP (VIP) by making an API call: * To replace the certificate of a manager node, use the POST API call: https://<nsx- mgr>/api/v1/node/services/http?action=apply_certificate&certificate_id=<certificate_id> * To replace the certificate of the manager cluster VIP, use the POST API call: https://<nsx-mgr>/api/v1/cluster/api- certificate?action=set_cluster_certificate&certificate_id=<certificate_id>