Useful command for KMS vCenter for ESXi hosts

By Kader May 11, 2024 #Encryption, #esx, #key provider, #kms, #nkp, #secure boot, #tpm esxi

#Verify that the ESXi host is in TPM mode
esxcli system settings encryption get

#If the Mode appears as NONE, you must enable the TPM in the firmware of the host, and set the mode
esxcli system settings encryption set --mode=TPM

#Enable secure boot in the firmware of the host then run this command
esxcli system settings encryption set --require-secure-boot=T

#To enable key persistence (if reboot esxi host and kms is not available) 
esxcli system security keypersistence enable

#To save the setting
/sbin/auto-backup.sh

#Secure ESXi Configuration Recovery Key
esxcli system settings encryption recovery list

#To disable persistence
esxcli system security keypersistence disable --remove-all-stored-keys