How to update Secure Boot Platform Key for VCD tenant VMs

Products

• VMware Cloud Director

Issue/Introduction

When a manual update of the Secure Boot Platform Key (PK) for virtual machines is required in a VMware Cloud Director (VCD) environment, tenant users cannot perform this independently. 
The Tenant Portal and VCD API do not provide the functionality to modify advanced configuration parameters, preventing tenant users from completing the update procedure described in following KB 423919.

Manual Update of the Secure Boot Platform Key in Virtual Machines

 

Note: If the virtual machine is running on VMware ESXi 8.0 U3j (P09) and the vTPM is disabled, the PK can be updated simply by rebooting the guest OS. For more details, refer to KB 423893.

Secure Boot Certificate Expirations and Update Failures in VMware Virtual Machines

Environment

VMware Cloud DIrector 10.6.x

Resolution

VCD does not provide tenant users with the functionality to directly modify a virtual machine's advanced configuration parameters.Therefore, enabling and disabling the uefi.allowAuthBypass = "TRUE" setting needs to be performed by the Provider Administrator via the vSphere Client.

Other steps, such as taking snapshots, attaching a disk for OEM PK placement, and enrolling the key from the UEFI, can be performed directly from the Tenant Portal.

Note: By attaching a named disk to any virtual machine, formatting it with FAT32, and placing the PK from the guest OS side, other virtual machines can reuse the PK on this named disk.

 

The following is an example of the procedure for adding a PK to VCD tenant virtual machines using a named disk:

1. [Tenant User via Tenant Portal]: Create a named disk, attach it to an available virtual machine, format it with the FAT32 file system, and save the WindowsOEMDevicesPK.der file onto the disk.
2. [Tenant User via Tenant Portal]: Shut down the target VM.
3. [Tenant User via Tenant Portal]: Take a snapshot of the target VM.
4. [Provider Admin via vSphere Client]: Add the advanced parameter uefi.allowAuthBypass = "TRUE" to the target VM requiring the PK update.
5. [Tenant User via Tenant Portal]: Attach the created named disk to the target VM and enable "Force EFI Setup" (Enter Boot Setup).
6. [Tenant User via VM Console]: Power on the VM, and proceed to enroll the PK from the UEFI.
7. [Provider Admin via vSphere Client]: If necessary, revert/remove the advanced parameter applied in step 4.

Note: Refer to KB 423919 for details on obtaining the WindowsOEMDevicesPK.der file and the procedure for enrolling the PK from the UEFI.

To add the PK to other virtual machines, repeat the process from Step 2 onwards for each target VM.