UEFI Secure Boot with vSphere Auto Deploy

Products

• VMware vSphere ESXi

Issue/Introduction

• Secure Boot is part of the UEFI firmware standard. With Secure Boot enabled, a machine refuses to load any UEFI driver or app unless the operating system boot loader is cryptographically signed. Starting with vSphere 6.5, ESXi supports Secure Boot if it is enabled in the hardware.
• In case of some of the older hardware platform or hardware with older firmware, you will see below errors while attempting to boot latest ESXi stateless with UEFI secure mode enabled. This is due to expiry of iPXE binary certificate "vmware_esx40.der" on 31st December 2019.

 “UEFI0073: Unable to boot PXE device”.

To resolve the issue refer below section.

Environment

VMware vSphere ESXi 7.0.0
VMware vSphere 6.7.x
VMware vSphere ESXi 6.7
VMware vSphere 6.5.x
VMware vSphere ESXi 6.5
VMware vSphere 7.0.x

Resolution

UEFI Secure Boot Overview

 

ESXi version 6.5 and later supports UEFI Secure Boot at each level of the boot stack. For more information, see the UEFI Secure Boot for ESXi Hosts section in the vSphere 6.5 Security Guide.

 

To use Secure Boot without Auto Deploy, it is sufficient to have either the UEFI-CA certificate or VMware's certificate enrolled in the UEFI firmware's allowlist (db variable), or both. Most machines have the UEFI-CA certificate preloaded in the default db by the hardware vendor.

 

Using Secure Boot with vSphere Auto Deploy

 

To use UEFI Secure Boot with vSphere Auto Deploy, you have to:

1. Enroll the VMware certificate in the UEFI firmware allowlist (db variable).
   1. Download the two VMware certificates attached to this KB article as vmware_sb.zip.
   2. Enroll the appropriate VMware certificate(s) in UEFI firmware.

• For ESXi 6.5.x, vmware_esx40.der is required.  
• For ESXi 6.7.x and later,  vmware_sb2017.der is preferred.  
• If needed, you can use both.

3. Enroll the VMware certificate in UEFI firmware.
   The procedure to manually enroll VMware certificates into the UEFI firmware's allowlist (db variable) depends on the machine's hardware vendor. Look for documentation from your hardware vendor on how to do the enrollment.
   For example, you can find the procedure for Dell hardware in Defining a Secure Boot Policy.
4. Use the VMware official key snponly64.efi.vmw-hardwired.officialkey.

Note: You may be asked for a SignatureOwner GUID when you enroll the VMware certificate. Secure Boot will function correctly no matter what GUID you use, but VMware suggests using the GUID a3d5e95b-0a8f-4753-8735-445afb708f62 in order to identify VMware as the owner of the certificate.

Ensure to follow Auto Deploy Best Practices in the vSphere Installation and Setup Guide.

Disclaimer: VMware is not responsible for the reliability of any data, opinions, advice, or statements made on third-party websites. Inclusion of such links does not imply that VMware endorses, recommends, or accepts any responsibility for the content of such sites