Understanding TLS version compatibility and requirements for host storage interfaces

Products

• VMware vSphere ESXi
• VMware Telco Cloud Infrastructure

Issue/Introduction

• This is an informational article addressing Transport Layer Security (TLS) protocol compatibility and operational considerations between VMware vSphere ESXi 7.0.x hosts and external storage array management interfaces, VASA Providers, or REST API endpoints.
• This article provides guidance on supported TLS versions, expected behaviors, and configuration guidelines when planning TLS security policies across backend storage environments connected to ESXi 7.x hosts.

Environment

ESXi: 7.0

TCI: 2.2

Cause

• ESXi 7.0 enforces TLS 1.2 by default for management and transport services while disabling legacy TLS (1.0 and 1.1) by default and offering no support for TLS 1.3, which can lead to handshake failures if external storage endpoints do not support TLS 1.2.

Resolution

 

1. Ensure external storage array management endpoints, VASA Providers, and REST APIs are configured to support TLS 1.2.

2. Verify the configured disabled TLS protocols on an ESXi host by executing the following ESXCLI command:

   esxcli system settings advanced list -o /UserVars/ESXiVPsDisabledProtocols
   

3. If communication with legacy storage systems requiring TLS 1.0 or TLS 1.1 is necessary, use the vSphere TLS Reconfigurator utility (tls_configurator) on the ESXi host to re-enable legacy protocols.

4. Do not enforce TLS 1.3 exclusively on backend storage controllers, as ESXi 7.x hosts do not support TLS 1.3 protocol negotiation.

 

Additional Information

 

• Managing TLS Protocol Configuration with the TLS Configurator Utility

• Enabling or Disabling TLS Versions in vSphere