Under certain circumstances, the ESXi host cannot get the key (KEK) for an encrypted virtual machine or an encrypted virtual disk from vCenter Server. In that case, you can still unregister or reload the virtual machine. However, you cannot perform other virtual machine operations such as deleting the virtual machine or powering on the virtual machine. The virtual machine is locked.

About this task

If the virtual machine key is not available, the state of the virtual machine in the vSphere Web Client displays as invalid. The virtual machine cannot power on. If the virtual machine key is available, but a key for an encrypted disk is not available, the virtual machine state does not display as invalid. However, the virtual machine cannot power on and the following error results:

The disk [/path/to/the/disk.vmdk] is encrypted and a required key was not found.

Procedure

  1. If the problem is the connection between the vCenter Server system and the KMS, restore the connection.

    When the KMS becomes available, the virtual machines are unlocked.

    Note that losing the connection to the KMS does not automatically lock the virtual machine. The virtual machine only enters a locked state if the following conditions are met:

    • The key has to be validated.

    • The key is not available on the ESXi host.

    • The ESXi host cannot retrieve the key from the vCenter Server system.

    After each reboot, an ESXi host must be able to reach vCenter Server and retrieve keys.

  2. If the connection is restored and an error results when you attempt to register the virtual machine, verify that you have the Cryptographic operations > Manage keys privilege for the vCenter Server system.

    This privilege is not required for powering on an encrypted virtual machine if the key is available. This privilege is required for registering the virtual machine if the key has to be retrieved again.

  3. If the key is no longer active on the KMS, ask the KMS administrator to restore the key.

    You might encounter an inactive key if you are powering on a virtual machine that had been removed from the inventory and that had not been registered for a long time. It also happens if you reboot the ESXi host, and the KMS is not available.

    1. Retrieve the key ID by using the Managed Object Browser (MOB) or the vSphere API.

      Retrieve the keyId from VirtualMachine.config.keyId.keyId.

    2. Ask the KMS administrator to reactivate the key that is associated with that key ID.

    If the key can be restored on the KMS, vCenter Server retrieves it and pushes it to the ESXi host the next time it is needed.

  4. If the KMS is accessible and the ESXi host is powered on, but the vCenter Server system is unavailable, follow these steps to unlock virtual machines.
    1. Restore the vCenter Server system, or set up a different vCenter Server system as a KMS client.

      You must use the same cluster name, but the IP address can be different.

    2. Reregister all virtual machines that are locked.

      The new vCenter Server instance retrieves the keys from the KMS and the virtual machines are unlocked.