Guide to Configuring Physical TPM 2.0 on VMware ESXi and Enabling Host Attestation

Network firewalls and antivirus software inside virtual machines (VMs) are completely useless if an attacker injects malicious code into the physical host’s BIOS or bootloader. Last year’s PCI-DSS audit at our company was an eye-opener for our team. All 8 of our production ESXi nodes failed simply due to the lack of a hardware integrity verification mechanism. The most comprehensive solution is to equip each server with a physical TPM 2.0 chip and enable Host Attestation in vCenter.

Comparing ESXi Host Integrity Monitoring Methods

To detect unauthorized tampering with firmware or the hypervisor kernel early, administrators have three main options:

• Method 1: Manual Monitoring and Log Collection — Use scripts to inspect hashes of VIB packages and forward logs to a SIEM (such as Wazuh or Splunk). This approach only detects an incident after it has already occurred.
• Method 2: Enabling UEFI Secure Boot Only — ESXi blocks drivers that lack a valid VMware digital signature. However, the system does not retain a boot-phase audit trail for verification.
• Method 3: Combining UEFI Secure Boot + TPM 2.0 + Host Attestation — The server measures each boot stage (measured boot) starting from power-on. Hash values are recorded into Platform Configuration Registers (PCRs) on the TPM chip, and vCenter then automatically validates host trustworthiness.

Pros and Cons of Each Approach

Choosing the Right Solution for Your Environment

For lab environments or internal test servers, standalone UEFI Secure Boot offers sufficient security. However, for production clusters, equipping hosts with physical TPM 2.0 is a mandatory investment. This is especially true when deploying Windows 11 or Windows Server 2022/2025 VMs that require vTPM—ESXi relies on a physical TPM to generate secure VM encryption keys rather than storing software keys on storage.

Step-by-Step Configuration of TPM 2.0 and Host Attestation

Step 1: Configure Hardware and Enable TPM 2.0 in BIOS/UEFI

Install the correct TPM 2.0 module compatible with your server model (e.g., part number 0F7T4V for Dell PowerEdge R740/R750). Then boot into the BIOS (System Setup):

• Set Boot Mode to UEFI Mode (disable Legacy BIOS completely).
• Navigate to System Security (on Dell) or Server Security (on HPE).
• Set TPM Security to Enabled / On.
• Under TPM Advanced Settings, ensure TPM PPI (Physical Presence Interface) is enabled so the OS has permission to read data.
• Set Secure Boot to Enabled.
• Save the configuration and reboot into ESXi.

Step 2: Verify TPM 2.0 Detection on ESXi via SSH

Establish an SSH connection to the ESXi host (version 7.0 Update 2 or 8.0+) and run the following command to check encryption status:

# 1. Check encryption status and Secure Boot
esxcli system settings encryption get

# Expected output:
# Mode: TPM
# Require Secure Boot: true

Next, confirm that the ESXi TPM driver has loaded successfully:

# 2. Check VMkernel boot log for TPM module detection
zcat /var/log/boot.gz | grep -i tpm

# Expected output: tpm-crb or tpm-tis driver appears with TPM 2.0 version

If the log shows timeout errors or indicates that the device was not found, open the server chassis and verify the physical connection of the TPM module on the motherboard.

Step 3: Verify Host Attestation in vCenter Server

Once ESXi finishes booting, vCenter will automatically trigger the integrity attestation workflow:

1. Log in to the vSphere Client (HTML5).
2. Select the newly configured ESXi host in the Cluster inventory.
3. Navigate to the Summary tab and locate the Security card/widget on the right side.
4. If the status displays TPM 2.0: Passed and Secure Boot: Enabled with green checkmarks, setup is complete.

If the interface displays a red Attestation Failed alert, follow the troubleshooting steps below.

Troubleshooting and Practical Field Tips

1. Resolving “Host Attestation Failed: Failed to verify identity / integrity”

This error commonly occurs when you replace hardware components or when the ESXi certificates drift from records stored in vCenter. There is no need to reinstall ESXi. The standard 3-step fix in the vSphere Client is:

1. Place the host into Maintenance Mode.
2. Right-click the host, select Certificates > Refresh CA Certificates, and then select Renew Certificate.
3. Right-click the host, select Connection > Disconnect, wait 30 seconds, and select Reconnect.

At this point, vCenter will resynchronize the Endorsement Key (EK) and re-read the PCR registers from the TPM chip. The status will immediately turn green.

2. Purple Screen of Death (PSOD) Caused by Unsigned VIBs

Secure Boot strictly enforces digital signatures on installed VIB packages. If you previously installed custom network or RAID drivers marked as CommunitySupported, ESXi will fail to boot immediately. Before enabling Secure Boot in BIOS, inspect and remove these packages with the following commands:

# List VIB packages lacking VMware certification
esxcli software vib list | grep -E "CommunitySupported|Unknown"

# Remove unsigned packages before rebooting (e.g., net-e1000e)
esxcli software vib remove -n net-e1000e

Only enable Secure Boot when this list is completely clear. This simple check will prevent unexpected downtime and boot failures.