Error: "The new host TPM endorsement key doesn't match the one stored in the DB" appears on ESXi hosts in a vSAN cluster

Products

• VMware vCenter Server 8.0

Issue/Introduction

After changing the system board with a Trusted Platform Module (TPM), an error message appears within the vSphere Client or on an ESXi host. The affected host is part of a vSAN cluster. The following error displays regarding the TPM endorsement key:

The new host TPM endorsement key doesn't match the one stored in the DB

Environment

• VMware vCenter Server 8.x
  
  
• VMware vSphere ESXi 8.x

Cause

A mismatch exists between the key value generated by the new TPM and the key value stored in the vCenter Server database (VCDB). The VCDB stores the TPM endorsement key under the VPX_HOST table. This mismatch causes the host in the vSAN cluster to report the validation error.

Resolution

The following steps clear the outdated TPM keys from the vCenter Server PostgreSQL database and register the newly generated TPM keys.

1. Take an appropriate snapshot of the vCenter.
   
   Note: In Enhanced Linked Mode (ELM) deployments, ensure all linked vCenters are powered off before taking Snapshots. Additional information may be found in KB Snapshot Best practices for vCenter Server Virtual Machines.
   
   
2. Place the affected host into Maintenance Mode.
   
   
3. Connect to vCenter via SSH as the root user.
   
   
4. Enable and access the Bash shell, if not already enabled. For details, refer to Enable and Access the Bash Shell from the Appliance Shell.
   
   
5. Stop the VPXD service:
   
   service-control --stop vpxd
   
   
6. Identify the affected Host ID
   
   Option 1 - List all hosts:
   
   /opt/vmware/vpostgres/current/bin/psql -U postgres -d VCDB -h localhost -c "select ID,DNS_NAME,endorsement_key,attestation_identity_key from VPX_HOST;"
   
   Option 2 - Retrieve a specific host's details:
   
   /opt/vmware/vpostgres/current/bin/psql -U postgres -d VCDB -h localhost -c "select id,dns_name,endorsement_key,attestation_identity_key from VPX_HOST WHERE dns_name = 'FQDN_of_issued_host.domain';"
   
   Note: Replace the FQDN_of_issued_host.domain with the fully qualified domain name of the affected host.
   
   
7. Clear the key value information by updating the endorsement_key and attestation_identity_key fields for the affected host:
   
   /opt/vmware/vpostgres/current/bin/psql -U postgres -d VCDB -h localhost -c "update VPX_HOST set endorsement_key='', attestation_identity_key='' where id = <Host_ID_from_step_6>;"
   
   
8. Confirm the key value for the affected host has been cleared:
   
   /opt/vmware/vpostgres/current/bin/psql -U postgres -d VCDB -h localhost -c "select ID,DNS_NAME,endorsement_key,attestation_identity_key from VPX_HOST where id = <Host_ID_from_step_6>;"
   
   
9. Start the VPXD service:
   
   service-control --start vpxd
   
   
10. Disconnect and reconnect the affected host within the vSphere Client.
    
    
11. Verify that new key values are populated in the VPX_HOST table:
    
    /opt/vmware/vpostgres/current/bin/psql -U postgres -d VCDB -h localhost -c "select ID,DNS_NAME,endorsement_key,attestation_identity_key from VPX_HOST where id = <Host_ID_from_step_6>;"
    
    
12. Exit the host from Maintenance Mode.  
    
    
13. Consolidate the snapshot on the vCenter Server Virtual Machine after verifying the issue resolves.

Additional Information

For alternative options in non-vSAN clusters, refer Error: "The new host TPM endorsement key doesn't match the one stored in the DB" appears within the vSphere Client".