vCenter Key Provider identification for vTPM VM restoration and creation

Products

• VMware vCenter Server 8.0

Issue/Introduction

When managing multiple Key Providers in vCenter Server 8.0, users may encounter the following scenarios:

• A restored virtual machine (VM) with a vTPM fails to power on or decrypt.
• The vCenter inventory displays the message: "Multiple Native Key Providers are configured. Consult the documentation for guidelines and best practices."
• Attempts to add a vTPM to a new VM default to the wrong Key Provider.
• Cross-vCenter vMotion or restoration fails with "Key provider [name] not found."

Environment

vCenter Server 8.x

Cause

vCenter Server does not dynamically choose a Key Provider for a VM. Instead, it maintains a metadata record that links a VM’s cryptographic state to a specific Key Provider object by name in its internal database.

Resolution

To ensure successful restoration and management of VMs with vTPM in environments with multiple providers, follow these procedures:

1. Standardize Key Provider Names 
   • Ensure that the destination vCenter has a Key Provider configured with the exact same name as the source environment. vCenter will fail to associate a VM with its key if the provider name differs, even if the backend KMS is identical.
2. Configure Provider for New Virtual Machines
   • When creating a new VM and adding a vTPM, specify the Key Provider by selecting the appropriate Encryption Storage Policy associated with that provider.
3. Restoring or Migrating Virtual Machines
   • If the original Key Provider is not present on the destination vCenter, import the .p12 backup from the source vCenter to the destination.
   • Perform a "shallow re-key" using the vSphere Client after migration to update the VM's association to the destination's default provider.
4. Changing Cluster Configurations
   • Changing a cluster's Key Provider settings does not automatically re-key running Virtual Machines.
   • Ensure the old provider remains accessible to vCenter.
   • Explicitly perform a Re-Encrypt operation on all associated VMs.
   • Only remove the old provider once all VMs have been successfully re-keyed.

Additional Information

• For instructions on backing up and restoring providers, see Contact Support.
• Review “Multiple Native Key Providers are configured. Consult the documentation for guidelines and best practices.” message seen in vCenter. regarding the "Multiple Native Key Providers" health warning.