Host Requires Encryption Mode Enabled Alarm After ESXi Host Migration from another vSphere environment
search cancel

Host Requires Encryption Mode Enabled Alarm After ESXi Host Migration from another vSphere environment

book

Article ID: 450629

calendar_today

Updated On:

Products

VMware vSphere ESXi

Issue/Introduction

The "Host Requires Encryption Mode Enabled" alarm occurring on ESXi hosts after migration between vCenter environments. This behavior occurs when stale cryptographic metadata exists in the vCenter database or on the ESXi host, preventing the alignment of encryption policies.

Symptoms:

  • "Host Requires Encryption Mode Enabled" alarm triggers post-migration.
  • Host shows "Host Encryption Mode: Disabled" in vCenter.
  • Attempts to enable Host Encryption Mode result in an error referencing TPM requirements

Environment

  • VMware vSphere ESXi
  • vCenter Server

Cause

The alarm is caused by a cryptographic state mismatch between the ESXi host's local metadata and the vCenter Server database. The host retains legacy Key Provider or HostKey references from the source vCenter environment. Additionally, stale network bindings, specifically DNS resolution failures, may lock management agents and prevent the host from being removed from inventory.

Resolution

  1. Verify DNS Resolution for ESXi Host FQDN

    • Log in to the vCenter Server Appliance (VCSA) via SSH as root.

    • Test forward and reverse DNS lookup for the host: nslookup <ESXi_Host_FQDN> nslookup <ESXi_Host_IP>

    • Verify that both match the hostname registered in vCenter.

  2. Place the Host in Maintenance Mode

    • In the vSphere Client, right-click the target ESXi host and select Maintenance Mode > Enter Maintenance Mode.

    • Select the appropriate vSAN data evacuation mode (e.g., Ensure Accessibility) if applicable.

  3. Disconnect the Host from vCenter Server

    • In the vSphere Client inventory tree, right-click the ESXi host.

    • Select Connection > Disconnect.

    • Confirm the prompt and wait for the host status to change to Disconnected.

  4. Remove the Host from vCenter Inventory

    • Right-click the disconnected ESXi host and select Remove from Inventory.

    • Confirm removal. (Note: This flushes host associations and clears stale cryptographic identity/endorsement keys stored in the vpx_host database table).

  5. Re-add the Host to vCenter Inventory

    • Right-click the Target Datacenter or Cluster and select Add Host...

    • Enter the host's FQDN and root credentials.

    • Accept the security certificate prompt to force a new cryptographic handshake and rebuild host metadata in vCenter.

    • Assign the proper license and complete the wizard.

  6. Exit Maintenance Mode & Verify Status

    • Right-click the ESXi host and select Maintenance Mode > Exit Maintenance Mode.

    • Navigate to the ESXi host's Configure > System > Security Profile tab.

    • Under Host Encryption Mode and Attestation, verify that the status is updated and green (e.g., Passed or Enabled).

Powered by Wolken Software