DELL VxRail TPM and Secure Boot Technical Instructions

: June 9, 2024
: Dell

Table of Contents

Procedure summary
How to Enable Secure Boot
How to Enable TPM and Secure Boot
How to Disable TPM
How to Enable Hierarchy
Documents / Resources
- Read User Manual Online (PDF format)
- Download This Manual (PDF format)

VxRail TPM and Secure Boot Technical
Instructions Dell VxRail TPM and Secure Boot
Technical note
May 2022

Abstract
This document describes how to resolve “Host Secure Boot was disabled” issues, by either enabling Secure Boot or disabling the TPM module.
Copyright
The information in this publication is provided as is. Dell Technologies believes the information in this document is accurate as of its publication date. The information is subject to change without notice.
Copyright © [2022] Dell Technologies or its subsidiaries. All Rights Reserved.

Procedure summary

By default, VxRail ships from the factory with TPM module enabled and Secure Boot disabled. After you receive the VxRail and complete VxRail Manager first run, the host
might not pass attestation. To resolve “Host Secure Boot was disabled” issues, either enable Secure Boot or disable the TPM module.
Note: VMware QuickBoot is not supported when Secure Boot is enabled.
To enable Secure Boot, see the ‘How to Enable Secure Boot” section of this document.
After enabling Secure Boot, if the TPM hierarchy is disabled by mistake, the host might not pass attestation. To resolve the “Unable to provision Endorsement Key on TPM 2.0 device: Endorsement Key creation failed on device.”/ “Internal failure” issue, see the ‘How to Enable Hierarchy’ section of this document.
To disable the TPM module, see the ‘How to Disable TPM” section of this document.
If after disabling the TPM, you want to enable Secure Boot, see the ‘How to Enable TPM and Secure Boot” section of this document. In this case, the host might show “N/A” message in attestation view until the TPM and Secure Boot are enabled.

How to Enable Secure Boot

View the ESXi host alarm status and accompanying error message.
Connect to vCenter Server by using the vSphere Client.
Select a data center and click the Monitor tab.
Click Security.
Review the host status in the Attestation column and read the accompanying message in the Message column.
If the error message is “Host Secure Boot was disabled”, you must enable Secure Boot to resolve the problem.
Verify whether Secure Boot can be enabled. If it cannot be enabled, contact Dell Tech Support.
Enable Secure Boot:
a. From the VMware vCenter vSphere Client, move one node to Enter Maintenance Mode.b. Log in to iDRAC to configure Secure Boot, and select the Configure tab > BIOS Settings > System Security > TPM Advanced Settings.
c. Select Secure Boot enable and click Apply > OK > Apply and Reboot.d. Click Job queue. Wait for all jobs to complete 100%.e. Log in to the VMware vCenter vSphere Client and set the node to Exit Maintenance Mode.
Perform Step 8 on each node until all nodes have Secure Boot enabled from iDRAC.
Log in to VMware vCenter vSphere Client and select the data center.
Click the Monitor and Security tab to verify that the latest Attestation status shows “Passed”.
If you see the alarm with a red icon, select it and click RESET TO GREEN.

How to Enable TPM and Secure Boot

View the ESXi host alarm status and accompanying error message.
Connect to VMware vCenter Server using the VMware vSphere Client.
Select a data center and click the Monitor tab.
Click Security.
Review the host status in the Attestation column and read the accompanying message in the Message column.
If the error message is “N/A”, enable TPM and Secure Boot to resolve the issue.
Verify whether Secure Boot can be enabled. If it cannot be enabled, contact Dell Tech Support.
Enable TPM and Secure Boot:
a. From the VMware vCenter vSphere Client, move one node to Enter Maintenance Mode.
b. Log in to iDRAC to configure Secure Boot, and select the Configure tab > BIOS Settings > System Security > TPM Security “On” > TPM Advanced Settings.
c. Select Secure Boot “enable” and click Apply > OK > Apply and Reboot.
d. Click Job queue. Wait for all jobs to complete 100%.
e. Go to Dashboard > Virtual Console to see if console shows “successfully completed”; if yes, continue.f. Log in to VMware vCenter vSphere Client and disconnect the node.
g. Reconnect the node, and then Exit Maintenance Mode.
Perform Steps 7 and 8 on each node until all nodes have TPM and Secure Boot enabled from iDRAC.
Log in to VMware vCenter vSphere Client and go to the data center.
Click the Monitor and Security tab to verify that the latest Attestation status is “Passed”. If you see an alarm with a red icon, select the specific Triggered Alarm and click RESET TO GREEN.

How to Disable TPM

Note: Before you disable TPM, ensure that Secure Boot has been enabled on the host.

View the ESXi host alarm status and accompanying error message.
Connect to VMware vCenter Server by using the VMware vSphere Client.
Select a data center and click the Monitor tab.
Click Security.
Review the host status in the Attestation column and read the accompanying message in the Message column.
If the error message is “Host Secure Boot was disabled”, you must disable TPM to resolve the problem if you do not want to enable Secure Boot.
If you see an alarm with a red icon, select the specific Triggered Alarm and click RESET TO GREEN.
Disable TPM:
a. From the VMware vCenter vSphere Client, move one node to Enter Maintenance Mode.
b. Log in to iDRAC to configure Secure Boot, and select the Configure tab > BIOS Settings > System Security > TPM Security “Off” > TPM Advanced Settings.
c. Select Secure Boot “disable” and click Apply > OK > Apply and Reboot.
d. Click Job queue. Wait for all jobs to complete 100%.
e. Go to Dashboard > Virtual Console to see if console shows “successfully completed”; if yes, continue.
f. Log in to the VMware vCenter vSphere Client and select Exit Maintenance Mode.
Perform Steps 7 and 8 on each node until all nodes have TPM disable from iDRAC.
Log in to VMware vCenter vSphere Client and select a data center.
Select the Monitor and Security tab to verify that the latest Attestation message failed. The TPM version and TXT show “N/A” and Message shows “Host Secure Boot was disabled”.

How to Enable Hierarchy

View the ESXi host alarm status and accompanying error message.
Connect to VMware vCenter Server by using the VMware vSphere Client.
Select a data center and click the Monitor tab.
Click Security.
Review the host status in the Attestation column and read the accompanying message in the Message column.
If the error message is “Unable to provision Endorsement Key on TPM 2.0 device: Endorsement Key creation failed on device”, you must enable TPM Hierarchy
to resolve the issue.
If you see an alarm with a red icon, select the specific Triggered Alarm and click RESET TO GREEN.
Enable TPM hierarchy:
a. From the VMware vCenter vSphere Client, move one node to Enter Maintenance Mode.
b. Log in to iDRAC to configure Secure Boot, and select the Configure tab > BIOS Settings > System Security > TPM >.
c. Select TPM Hierarchy “Enable” and click Apply > OK > Apply and Reboot.
d. Click Job queue. Wait for all jobs to complete 100%.
e. Go to Dashboard > Virtual Console to see if console shows “successfully completed”; if yes, continue.
f. Log in to the VMware vCenter vSphere Client and select Exit Maintenance Mode.
Perform Steps 7 and 8 on each node until all nodes have TPM hierarchy enabled from iDRAC.
Login VMware vCenter vSphere Client and select a data center.
Click the Monitor tab > Security to verify latest Attestation message as “Passed”.