ESXi PSOD when UEFI secure boot is enabled and system time is incorrect

Products

• VMware vSphere ESXi

Issue/Introduction

• ESXi host with secure boot enabled experiences PSOD if the system time is incorrectly configured. (Refer the below PSOD snippets)
• Error snippets
  • UEFI secure boot failed at time YYYY-MM-DD T HH:MM:SS
  • Failed to verify signatures of the following vibs (xx)".
• ESXi host successfully boots up without secure boot. 

Environment

• VMware vSphere ESXi 7.x
• VMware vSphere ESXi 8.x

Cause

The system time of the ESXi host at BIOS and inside ESXi host was incorrectly configured.

Resolution

Secure boot is part of the UEFI firmware standard. With secure boot enabled, a machine refuses to load any UEFI driver or app unless the operating system bootloader is cryptographically signed. (This is expected behavior if you have secure boot enabled.)

Please perform the below steps to resolve the issue. 

• Boot to UEFI setup menu
• Navigate to date and time.
• Set the correct system time
• Save and exit UEFI setup.
• The system will successfully boot into OS.
• If the system fails to boot disable the secure boot continue with the normal boot process.
• Ensure that the time and date settings inside the ESXi host are same as that of the BIOS/UEFI setting. 
• In case if NTP is configured and not reachable or any issue persists please have that fixed or manually update and time/date settings to fix the issue.
• Enable the secure boot back by rebooting the host to fix the issue.

 

Additional Information

Secure boot is part of the UEFI firmware standard. With secure boot enabled, a machine refuses to load any UEFI driver or app unless the operating system bootloader is cryptographically signed.

With secure boot enabled, the boot sequence proceeds as follows.

1. Starting with vSphere 6.5, the ESXi bootloader contains a VMware public key. The bootloader uses this key to verify the signature of the kernel and a small subset of the system that includes a secure boot VIB verifier.
2. The VIB verifier verifies every VIB package that is installed on the system.

Reference Doc: https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/vsphere-security-7-0.html