ESXi Host TPM Attestation Fails Despite BIOS Configuration

Products

• VMware vSphere ESXi

Issue/Introduction

After configuring TPM 2.0 hardware on an ESXi host and verifying it is enabled in the BIOS, vCenter Server displays a status of "Host TPM Attestation failed". Logs in vpxd.log may show identity key database errors or trust establishment failures.

• Host TPM Attestation failed in vCenter UI.
• N7Vmacore9ExceptionE(No identity key in DB, try to reconnect host) in vpxd.log.
• fault: (vim.fault.TpmTrustNotEstablished) during SOAP calls to InternalTpm20Manager.

 

Environment

VMware vSphere ESXi 8.x
vCenter Server 8.x

Cause

This issue typically occurs when the vCenter Server cannot establish or verify a chain of trust with the host's TPM 2.0 chip. Common root causes include:

1. Missing Intermediate/Root CA Certificates: The TPM vendor's CA certificates are not present in the vCenter Trusted Root Store.
2. Trust Disruption: A mismatch between the host's TPM identity and the information cached in the vCenter database.
3. Prerequisite Gaps: Lack of a configured Key Provider or the host not being part of a cluster when attempting to use TPM for Virtual Machines.

Resolution

 Prerequisites
- Take a snapshot of the vCenter Server Appliance (VCSA).
- Ensure TPM 2.0 and UEFI Secure Boot are enabled in the host BIOS.

 Step 1: Extract the TPM CA Certificate from a Working Host
If you have a similar host that is successfully attested, use PowerCLI to extract the certificate.
powershell
Connect-VIServer -Server <vcenter_fqdn>
$esxHost = Get-VMHost -Name "<Working-Host-FQDN>"
$catTPM = Get-Tpm2EndorsementKey -VMHost $esxHost
Export-Tpm2CACertificate -Tpm2EndorsementKey $catTPM -FilePath "C:\temp\tpm-cacert.zip"

 Step 2: Manually Retrieve Certificate from vCenter Logs (Alternative)
If no working host is available, you can attempt to capture the certificate during a reconnect operation.
1. SSH to the vCenter Server.
2. Run the following loop to catch the certificate file when it is temporarily downloaded to the /tmp directory:
   
   while true; do cp /tmp/vmware-vpxd/.cert /root/ 2>/dev/null; done
   
3. In the vSphere Client, Disconnect and then Reconnect the affected ESXi host.
4. Check the /root/ directory for the captured .cert file.

 Step 3: Import the Certificate to vCenter Trusted Root Store
1. Log in to the vSphere Client.
2. Navigate to Administration > Certificates > Certificate Management.
3. Under Trusted Root Certificates, click Add and upload the certificate file retrieved in the previous steps.

 Step 4: Configure Native Key Provider (If Required)
If using TPM for VMs, ensure a Native Key Provider is configured.
1. Go to vCenter Server > Configure > Key Providers.
2. Click Add > Add Native Key Provider.
3. Back up the Key Provider immediately after creation to enable it.

 Step 5: Re-trigger Attestation
1. Right-click the host in the inventory and select Connection > Disconnect.
2. Right-click the host again and select Connection > Connect.
3. Monitor the Summary tab to verify the TPM status changes to Passed.