Enable TPM on ESXi.

Products

• VMware vSphere ESXi

Issue/Introduction

This KB introduces the full process of enabling TPM on ESXi.

Resolution

1. Check if the TPM chip you are using supports TPM2.0 from Broadcom Compatibility Guide, especially check the BIOS version.
2. Put host to maintenance mode. Reboot host.
3. Enter Bios. Verify that TPM is enabled.
   1. If TPM is required to enable 2.0 in step 1, verify that algorithm is set to ONLY SHA256.
   2. If TPM is required to enable TXT in step 1, verify that Intel TXT is enabled in Bios.
4. Create an SSH session to ESXi. 
5. Run this command to check if all vibs are compatible to secure boot.

   /usr/lib/vmware/secureboot/bin/secureBoot.py -c

   Expected output is:

   Secure boot can be enabled: All vib signatures verified. All tardisks validated. All acceptance levels validated

6. Run this command to check if TPM is visible in ESXi.

   esxcli hardware trustedboot get

   Expected output is:

   Drtm Enabled: [true|false]
   Tpm Present: true

   1. If "Tpm Present" is "false", contact your hardware vendor.
7. Run this command to check secure boot status.

   esxcli system settings encryption get

   Expected output is:

   Mode: TPM
   Require Executables Only From Installed VIBs: false
   Require Secure Boot: true

   1. If "Mode" is "NONE", run this command to set it to "TPM".

      esxcli system settings encryption set --mode=TPM

   2. If "Require Secure Boot" is "false", run this command to set it to "true".

      esxcli system settings encryption set -s 1

8. Reboot host.
9. The TPM on ESXi should be available now.