After upgrading ESX to 9.1, the alarm "Host Requires Encryption Mode Enabled" is triggered.

Products

• VMware vCenter Server

Issue/Introduction

After upgrading ESX to 9.1, the alarm "Host Requires Encryption Mode Enabled" is triggered.  
Attempting to re-encrypt the ESX host from the vCenter UI fails with the error "Failed to enable encryption on host". 

From the ESX /var/run/log/kmxa.log you may see an error similar to the following:

ERROR kmxa 2098763 [esx@4413 sub="Libs" opID="decrypt-########-####-####-####-###########-0"] Decrypt on provider <nkp> failed to decrypt ciphertext

From the vCenter Server /var/log/vmware/vpxd/vpxd.log file you may see an error similar to the following:

ERROR vpxd 89269 [vc@4413 sub="CryptoManager" opID="HeartbeatStartHandler-61e20c98-892c9fa-VMcrypt-OnHostConnected-3749e9a0"] Failed to enable encryption on host [vim.HostSystem:host-12,<esx-fqdn>]: N5Vmomi5Fault11SystemError9ExceptionE(Fault cause: vmodl.fault.SystemError

Environment

vCenter 9.1
EX 9.1

Cause

The cause of this issue is still under investigation and a case with Broadcom support should be opened for further review.

Resolution

To resolve this issue, follow the steps below to ensure that the ESX NKP provider id matches the Key Provider as seen in the vCenter Server. 

 

1. Locate and identify the host MoRef ID belonging to the ESX host in question.  

• Login to the vCenter UI 
• Select the host in inventory
• Check the URL in the browser for the "host-**" ID

2. Identify the Key Provider name as displayed in the vCenter UI.

• Login to the vCenter Server UI
• Select the vCenter Server within the inventory tree
• Go to Configure > Security > Key Providers.  Locate the target key to be used and record the name as it is seen.  

 

 

2. Enable the MOB interface for the vCenter Server by following the steps outlined in "The MOB is disabled", unable to access the vCenter MOB in VCF 9.0

3. Login to the mob using the following URL after updating the host ID accordingly: https://<vc-fqdn>/mob/?moid=host-** 

• Using the host ID from the above screenshot:  https://<vc-fqdn>/mob/?moid=host-12

4. Under "Methods", find and select "ConfigureCryptoKey"

5. In the new window, update the providerid id field to match that of the Key Provider as seen in the vCenter UI.

6. Select "Invoke Method" at the bottom right.  A "Method Invocation Result: void" is expected.

7. Login to vCenter and confirm the alert for encryption on the target ESX host is resolved. Additional confirmation can be done by running the following command on the target ESX host from an SSH session to ensure a new key has been applied: 
crypto-util keys getkidbyname "HostKey"