Failed to verify signatures of following vib(s): [Vmware-fdm]. Unrecognized tardisks: [vmware_f.v00]

Products

• VMware vSphere ESXi

Issue/Introduction

Esxi host enters in PSOD when enabling secure boot.

This host shows below message:

Running below command on esxi before enabling secureboot:

 /usr/lib/vmware/secureboot/bin/secureBoot.py -c

Secure boot CANNOT be enabled: Failed to verify signatures of the following vib(s): [vmware-fdm]. Unrecognized tardisks: [vmware_f.v00]. All acceptance levels validated.

Environment

VMware vSphere Esxi 7.x

VMware vSphere Esxi 8.x

Cause

When vCenter installs vmware-fdm Vib it uses nosigcheck qualifier, However, secure boot will disable that ability and shows error could not verify signature of this Vib.

 

Resolution

To resolve this issue, Follow below procedure:

1. Put the host into maintenance mode.

2. Remove the fdm vib manually from esxi host using below command

        esxcli software vib remove -n vmware-fdm

Note: This is not applicable from ESX 9.0 onwards.

3. Enable secure boot on esxi and boot the esxi host.

4. Remove host from maintenance mode

5. Right click on host and select Reconfigure vsphere HA , fdm vib will be installed on the host.

 

If step 5 does not resolve the issue, we can install the vpshere HA vib manually:

1. Download fdm vib from vcenter server using winscp at below location:

/etc/vmware-vpx/docRoot/vSphere-HA-depot/vib20/vmware-fdm/

 

Note: This is not applicable from ESX 9.0 onwards as the FDM VIB is bundled as part of the ESX base image.

2. Upload this vmware-fdm vib to esxi /tmp drive:

3. Install the vib using below command:

esxcli software vib install -v /tmp/VMware_bootbank_vmware-fdm_x.x.0-xxxxxx.vib

Additional Information

https://blogs.vmware.com/vsphere/2017/05/secure-boot-esxi-6-5-hypervisor-assurance.html#:~:text=To%20use%20Secure%20Boot%20with,signed%20with%20the%20VMware%20certificate