ESXi host reports "TPM 2.0 device detected, but a connection cannot be established" after TPM enablement or post-upgrade to ESXi 8.0

Products

• VMware vSphere ESXi

Issue/Introduction

• When adding a TPM-enabled ESXi host to vCenter, or after enabling TPM 2.0 on an existing host, the following alert may be observed:
  
  TPM 2.0 device detected, but a connection cannot be established.
  
  
• This issue may also occur after upgrading the ESXi host to version 8.0, indicating a potential mismatch or incomplete TPM configuration despite the feature being enabled.
• When reviewing the vmkernel logs (/var/run/log/vmkernel.* and /var/run/log/vmkwarning.*), the following entries might be found:

  YYYY-DD-MMTHH:MM:SS.007Z cpu24:2097931)WARNING: tpmDriver: TpmDriverInitImpl:307: TPM 2 SHA-256 PCR bank not found to be active.
  YYYY-DD-MMTHH:MM:SS.007Z cpu24:2097931)WARNING: tpmDriver: TPMDriverAttachDevice:216: \_SB_.TPM_: couldn't perform TIS init
  YYYY-DD-MMTHH:MM:SS.008Z cpu24:2097931)WARNING: Elf: 3110: Kernel-based module load of tpmdriver failed: Failure <Mod_LoadDone failed>

Environment

• VMware vSphere ESXi 6.x
• VMware vSphere ESXi 7.0.x
• VMware vSphere ESXi 8.0.x

Cause

This issue usually occurs when the TPM settings are not correctly configured in the BIOS/EFI firmware of the physical server.
From ESXi 7.0 on, only SHA2 (SHA256) or higher security security algorithms are supported. If a SHA1 algorithm is configured in the BIOS TPM settings, errors as mentioned above will occur.

Resolution

1. Make sure that the TPM device is both enabled and active in the BIOS TPM configuration
2. A SHA-256 hashing algorithm shoudl be configured.
3. The TPM must be using the TIS/FIFO (first-in, first-out) interface, not the CRB (Command Response Buffer).

Refer to Securing ESXi Hosts with Trusted Platform Module for more information.
For assistance with configuring and verifying the configuration on a specific hardware platform connect with the respective server vendor.

Additional Information

As an example, this is the Dell documentation to address the issue: PowerEdge: Error on ESXi 7.0 TPM 2.0 device detected but a connection cannot be established.