"A general runtime error occurred. Key provider [Key Provider Name] is not compatible with host [Host FQDN]. Reason: 'TPM device is required'" when using vSphere Native Key Provider

Products

• VMware vSphere ESXi
• VMware vSphere ESXi 8.0

Issue/Introduction

When attempting to add a vTPM (Virtual Trusted Platform Module) to a virtual machine (often for Windows 11 guest OS) or enable Host Encryption Mode on an ESXi host, the task fails with the following error:

Environment

Esxi 8.x

Cause

The Native Key Provider (NKP) is configured to utilize the physical TPM 2.0 device on the ESXi host to "seal" (securely encrypt and bind) the host's primary key.
This error occurs because the physical TPM 2.0 chip on the ESXi host's hardware is not accessible, is disabled, or is not in a ready state.

Resolution

Enable TPM on ESXI.