Prerequisites:
You must be at least a Trust Authority administrator.
Procedure:
- Perform the following steps on the Trusted Host that is currently failing to attest.
- In a PowerCLI session, connect to the ESXi host that is failing to attest using the root user.
Connect - VIServer -server esxi_host -User root -Password ‘password'
- Assign the ESXi host to a variable.
$vmhost = Get-VMHost
- Assign the TPM Endorsement Key to a variable.
$tmp2 = Get-Tpm2EndorsementKey -VMHost $vmhost
- Export the TPM CA Certificate from the ESXi host. Ensure that the destination directory exists before running this command.
Export - Tpm2CACertificate -Tpm2EndorsementKey $tmp2 -FilePath C:\vta\cacert.zip
- Perform the following steps on the vSphere Trust Authority Cluster.
- Run the following commands to disconnect any current connection and connect to the vCenter Server of the Trust Authority Cluster using the Trust Authority administrator user.
Disconnect - VIServer -server * -Confirm:$false
Connect - VIServer -server TrustAuthorityCluster_VC_ip_address -User trust_admin_user -Password 'password'
- Assign the Trust Authority Cluster to a variable.
$TAcluster = Get-TrustAuthorityCluster "SB-Cluster"
- Import the TPM CA certificate previously exported from the ESXi host in step 1d.
New - TrustAuthorityTpm2CACertificate -Name tpmca -TrustAuthorityCluster $TAcluster -FilePath C:\vta\cacert.zip
- On the Trusted Host that is failing to attest, restart services or reboot the host.