HCX Cross-vCenter VM Migration Fails Due to Mismatched Native Key Provider Name

Products

• VMware HCX

Issue/Introduction

When attempting to migrate encrypted or vTPM-enabled Virtual Machines (VMs) across clusters using VMware HCX, the migration operation fails.

Symptoms include:

• ESXi hosts in the destination environment report an incapable or untrusted crypto state.

• Keys imported into the Native Key Provider (NKP) appear as "safe" via PowerCLI and in the vCenter UI, but fail to push down to the host level.

• General validation error messages are displayed in HCX without detailing specific configuration fixes.

• Hosts previously affected by blocked network/firewall ports controlling encryption traffic remain in an untrusted state until trust is re-established.

Environment

 

• VMware HCX

 

Cause

The Native Key Provider (NKP) name configured on the destination vCenter does not match the Native Key Provider name on the source vCenter, preventing encryption key synchronization and host-level key distribution during HCX migration.

Resolution

1. Verify network firewall rules to ensure all required encryption ports between source and destination vCenters and ESXi hosts are open.

2. Re-establish host trust across the ESXi hosts in the vCenter cluster to restore hosts from an untrusted/incapable state to an online/capable crypto state.

3. Log in to the destination vCenter Server via the vSphere Client.

4. Navigate to Configure > Security > Key Providers.

5. Update or re-import the Native Key Provider (NKP) configuration on the destination vCenter so that the NKP name exactly matches the NKP name on the source vCenter.

6. Perform a rolling reboot of the ACS manager / host key services if necessary to force proper host-level synchronization.

7. Retry the HCX VM migration task.

Additional Information

For additional guidance on key provider configurations during cross-vCenter migrations, see Cross-vCenter Migration Fails for TPM-Enabled Virtual Machines with Key Provider Error.