Error: Cannot apply encryption policy in VMware vSphere

Products

• VMware vCenter Server

Issue/Introduction

Enabling host encryption or configuring a Virtual Trusted Platform Module (vTPM) fails with a runtime error regarding the encryption policy or key provider compatibility.

The vSphere Client displays one of the following errors:

• "A general system runtime has occurred. Cannot apply encryption policy. You must set default key provider."
  
  
• Trusted Key provider is not compatible with host. Reason: "The host does not support Native Key Provider because it is not in a cluster."
  
  
• vCenter Server logs (/var/log/vmware/vpxd/vpxd.log) show entries similar to: 

[YYYY-MM-DDTHH:MM] error vpxd[#####] [Originator@#### sub=CryptoManager opID=########-####-auto-####-##:########-##] [vim.HostSystem:<host-moid>,<host-fqdn>] is not compatible with key provider TestKeyProvider: native key providers not supported.

[YYYY-MM-DDTHH:MM] error vpxd[#####] [Originator@#### sub=CryptoManager opID=########-####-auto-####-##:########-##] Trusted Key Provider is not compatible with host: com.vmware.vim.vpxd.encryption.NativeKeyProviderNotSupported

• If the Native Key Provider was restored or configured with the "Use key provider only with TPM protected ESXi hosts" enforcement, the task will fail on any host that does not have a physical TPM 2.0 device installed and enabled in the BIOS.

Environment

• vCenter 8.x
• vCenter 9.x

Cause

This issue occurs for the following reasons:

• Default Provider Missing: A default key provider has not been designated in vCenter Server.
• Standalone Host: vSphere Native Key Provider requires ESXi hosts to be members of a vSphere cluster
• TPM Enforcement: The key provider is set to "TPM protected hosts only" while the ESXi host lacks physical TPM 2.0 hardware.

Resolution

Follow the below options depending on the error. 

1. To resolve the "Default key provider" error:
   
   1. Log in to the vSphere Client.
   2. Select the vCenter Server object in the inventory.
   3. Navigate to the Configure tab.
   4. Under Security, select Key Providers.
   5. Locate the intended Key Provider (Native or Standard).
   6. Click the Set as Default button.
      • Note: If no key provider exists, one must be created or restored first.
   7. Return to the ESXi host and re-attempt to enable Host Encryption Mode.
      
      
2. To resolve "Not in a cluster" or compatibility errors:
   1. Ensure the ESXi host is a member of a cluster. Standalone hosts do not support Native Key Providers.
   2. If the host lacks a physical TPM 2.0 device
      
      • Back up the current Native Key Provider.
      • Delete the provider and select Restore Native Key Provider.
      • Upload the backup and uncheck the box: "Use key provider only with TPM protected ESXi hosts".

Additional Information

For more details, see vSphere Native Key Provider Overview