Cross-vCenter vMotion of VMs failing when using native key provider with error "Unable to decrypt the ciphertext. Failed to decrypt the key "

Products

• VMware vCenter Server

Issue/Introduction

Customers who have used a Native Key Provider (NKP) to encrypt the configuration files and/or disks on VMs will be unable to do a cross-vCenter vMotion of those VMs unless the NKP from the source vCenter is imported to the destination vCenter.

The vMotion fails at 100% with the error "Unable to decrypt the ciphertext. Failed to decrypt the key"

Resolution

Backup the Native Key Provider from the source vCenter using the following method:
Back up a vSphere Native Key Provider

 

Restore the Native Key Provider to the destination vCenter using the following method (do not Add a new NKP, immediately use the Restore option):
Restore a vSphere Native Key Provider Using the vSphere Client

 

Verify that the Key IDs match between the source and destination vCenters' NKPs. 

Re-attempt the cross-vCenter vMotion.