Registering ESXi Host with Intel SGX Registration Server fails with "SGX registration succeeded but GET on PCK certs failed"
search cancel

Registering ESXi Host with Intel SGX Registration Server fails with "SGX registration succeeded but GET on PCK certs failed"

book

Article ID: 407399

calendar_today

Updated On:

Products

VMware vCenter Server VMware vSphere ESXi

Issue/Introduction

  • When attempting to register an ESXi host with the Intel SGX Registration Server, the registration fails with "SGX registration succeeded but GET on PCK certs failed"




  • Logs on vCenter Server located at /var/log/vmware/vpxd/vpxd.log shows following entries:

YYYY-MM-DDThh:mm:ss info vpxd[31970] [Originator@6876 sub=vpxLro opId=a56280b0-b6be-4f1e-bcac-df5e22123c4f-48-389a9255] [VpxLRO] -- BEGIN task-309 -- <ESXi IP> -- sgx.register.host-3086:36f81e9f-d1a5-485a-ae77-1d27c8f33a0d --
YYYY-MM-DDThh:mm:ss info vpxd[31970] [Originator@6876 sub=SgxHostRegistration.Impl opId=a56280b0-b6be-4f1e-bcac-df5e22123c4f-48-389a9255] Sgx step get
YYYY-MM-DDThh:mm:ss error vpxd[25018] [Originator@6876 sub=SgxHostRegistration.Impl opId=a56280b0-b6be-4f1e-bcac-df5e22123c4f-48-389a9255] [VapiEsxJwtAuthenticationUpdater]Failed to get JWT token. Error:
--> Error:
-->  com.vmware.vapi.std.errors.unauthenticated
--> Messages:
-->  vapi.security.authentication.required<Authentication required>
-->
.
.
.
.
.
YYYY-MM-DDThh:mm:ss info vpxd[24715] [Originator@6876 sub=SgxHostRegistration.Impl opId=a56280b0-b6be-4f1e-bcac-df5e22123c4f-48-389a9255] [AsyncGetPCKCert] Sending request to "/external-ca/http1/sbx.api.trustedservices.intel.com/443/sgx/certification/v4/pckcerts"
YYYY-MM-DDThh:mm:ss info vpxd[24837] [Originator@6876 sub=SgxHostRegistration.Impl opId=a56280b0-b6be-4f1e-bcac-df5e22123c4f-48-389a9255] [operator()], Response code: 401
YYYY-MM-DDThh:mm:ss error vpxd[24837] [Originator@6876 sub=SgxHostRegistration.Impl opId=a56280b0-b6be-4f1e-bcac-df5e22123c4f-48-389a9255] [operator()] SGX GET PCK Certificate failed: status code = 401, error code = [unset], error message = [unset]
YYYY-MM-DDThh:mm:ss error vpxd[24837] [Originator@6876 sub=SgxHostRegistration.Impl opId=a56280b0-b6be-4f1e-bcac-df5e22123c4f-48-389a9255] SGX registration succeeded but GET on PCK certs failed: N4Vpxd15SgxRegistration15SgxServiceErrorE(SGX get PCK certs failed: status code = 401, error code = [unset], error message = [unset])
--> [context]zKq7AVECAQAAAB68eQETdnB4ZAAAyzdIbGlidm1hY29yZS5zbwAArDA3AA9VOIFNISsCdnB4ZACBCUsrAgDA5DwAUAk9ALiIOwCH9zwAdPk8APMkOwCDKTsAH2I7AOSwOwAE/CwAD1UtAOsqRgLEkAhsaWJjLnNvLjYAAmyREA==[/context]
YYYY-MM-DDThh:mm:ss info vpxd[24837] [Originator@6876 sub=vpxLro opId=a56280b0-b6be-4f1e-bcac-df5e22123c4f-48-389a9255] [VpxLRO] -- FINISH task-309
YYYY-MM-DDThh:mm:ss error vpxd[24837] [Originator@6876 sub=Default opId=a56280b0-b6be-4f1e-bcac-df5e22123c4f-48-389a9255] [VpxLRO] -- ERROR task-309 -- -- <ESXi IP> -- sgx.register.host-3086:36f81e9f-d1a5-485a-ae77-1d27c8f33a0d: :vim.fault.InvalidHostState
--> Result:
--> (vim.fault.InvalidHostState) {
-->  faultCause = (vmodl.MethodFault) null,
-->  faultMessage = (vmodl.LocalizableMessage) [
-->    (vmodl.LocalizableMessage) {
-->     key = "com.vmware.vcenter.confidential_computing.sgx.pck_cert_response_error",
-->     arg = (vmodl.KeyAnyValue) [
-->       (vmodl.KeyAnyValue) {
-->        key = "details",
-->        value = "SGX registration succeeded but GET on PCK certs failed: N4Vpxd15SgxRegistration15SgxServiceErrorE(SGX get PCK certs failed: status code = 401, error code = [unset], error message = [unset])

  • Logs on ESXi host located at /var/run/log/esxtokend.log shows following entries:

YYYY-MM-DDThh:mm:ss In(166) esxtokend[2102824]: [Originator@6876 sub=Http2ServerSession-4] Starting Http2Session (server): <io_obj t:N7Vmacore6System19TCPSocketObjectAsioE, h:13, <TCP '127.0.0.1 : 9199'>, <TCP '127.0.0.1 : 49719'>>
YYYY-MM-DDThh:mm:ss In(166) esxtokend[2102019]: [Originator@6876 sub=VapiHandler opID=9cc32a19-66ab-4e06-8dd7-596f2290db5a-70-4964e37e] Invoke-MethodId: com.vmware.esx.authentication.token.create
YYYY-MM-DDThh:mm:ss In(166) esxtokend[2102019]: [Originator@6876 sub=VapiHandler opID=9cc32a19-66ab-4e06-8dd7-596f2290db5a-70-4964e37e] Invoke-Input: {{ operation-input : { } }}
YYYY-MM-DDThh:mm:ss Er(163) esxtokend[2102019]: [Originator@6876 sub=SamlAuth opID=9cc32a19-66ab-4e06-8dd7-596f2290db5a-70-4964e37e] [AsyncSamlVerifierFilter] Invalid timestamp. RequestId: 1 Method:com.vmware.esx.authentication.token.create
YYYY-MM-DDThh:mm:ss Er(163) esxtokend[2102019]: [Originator@6876 sub=VapiHandler opID=9cc32a19-66ab-4e06-8dd7-596f2290db5a-70-4964e37e] MethodResult [FAIL] (MethodId:com.vmware.esx.authentication.token.create),Error:
YYYY-MM-DDThh:mm:ss Er(163) esxtokend[2100739]: -->com.vmware.vapi.std.errors.unauthenticated
YYYY-MM-DDThh:mm:ss Er(163) esxtokend[2100739]: --> Messages:
YYYY-MM-DDThh:mm:ss Er(163) esxtokend[2100739]: -->vapi.security.authentication.required<Authentication required>
YYYY-MM-DDThh:mm:ss Er(163) esxtokend[2100739]: -->

Environment

VCF 9.0
vCenter Server 8.x
vSphere ESXi 8.x

Cause

This issue occurs due to a time synchronization mismatch between ESXi host and the vCenter Server.

Resolution

To resolve this issue, ensure there is no time drift between the ESXi host and the vCenter Server.

  1. Verify the current time on both the affected ESXi host and the vCenter Server.

  2. Configure both the ESXi host and the vCenter Server to synchronize with reliable NTP (Network Time Protocol) or PTP (Precision Time Protocol) server.

  3. Verify that the time drift has been corrected and the time services are actively syncing.

  4. Re-initiate the Intel SGX registration process.

  5. Monitor the task in the vSphere Client to confirm successful completion.

Additional Information

Powered by Wolken Software