Encryption tasks are possibly only in environments that include vCenter Server. In addition, the ESXi host must have encryption mode enabled for most encryption tasks. The user who performs the task must have the appropriate privileges. A set of Cryptographic Operations privileges allows fine-grained control. If virtual machine encryption tasks require a change to the host encryption mode, additional privileges are required.

Note: vSphere Trust Authority has additional prerequisites and required privileges. See Prerequisites and Required Privileges for vSphere Trust Authority.

Cryptography Privileges and Roles

By default, the user with the vCenter Server Administrator role has all privileges. The No cryptography administrator role does not have the following privileges that are required for cryptographic operations.
Important: ESXi Shell users also have cryptographic operation privileges.
  • Add Cryptographic Operations privileges.
  • Global.Diagnostics
  • Host.Inventory.Add host to cluster
  • Host.Inventory.Add standalone host
  • Host.Local operations.Manage user groups

You can assign the No cryptography administrator role to vCenter Server administrators that do not need Cryptographic Operations privileges.

To impose more limits on what users can do, you can clone the No cryptography administrator role and create a custom role with only some of the Cryptographic Operations privileges. For example, you can create a role that allows users to encrypt but not to decrypt virtual machines. See Using Roles to Assign Privileges.

Host Encryption Mode

Host encryption mode determines if an ESXi host is ready to accept cryptographic material for encrypting virtual machines and virtual disks. Before any cryptographic operations can occur on a host, host encryption mode must be enabled. Host encryption mode is often enabled automatically when it is required, but you can enable it explicitly. You can check and explicitly set the current host encryption mode from the vSphere Client or by using the vSphere API.

When host encryption mode is enabled, vCenter Server installs a host key on the host, which ensures that the host is cryptographically "safe." With the host key in place, other cryptographic operations can proceed, including vCenter Server obtaining keys from the key provider and pushing them to the ESXi hosts.

In "safe" mode, user worlds (that is, hostd) and encrypted virtual machines have their core dumps encrypted. Unencrypted virtual machines do not have their core dumps encrypted.

For more information about encrypted core dumps and how they are used by VMware Technical Support, see the VMware knowledge base article at http://kb.vmware.com/kb/2147388.

For instructions, see Enable Host Encryption Mode Explicitly.

After Host encryption mode is enabled, it cannot be disabled easily. See Disable Host Encryption Mode Using the API.

Automatic changes occur when encryption operations attempt to enable host encryption mode. For example, assume that you add an encrypted virtual machine to a standalone host. Host encryption mode is not enabled. If you have the required privileges on the host, encryption mode changes to enabled automatically.

Assume that a cluster has three ESXi hosts, host A, B, and C. You create an encrypted virtual machine on host A. What happens depends on several factors.

  • If hosts A, B, and C already have encryption enabled, you need only Cryptographic operations.Encrypt new privileges to create the virtual machine.
  • If hosts A and B are enabled for encryption and C is not enabled, the system proceeds as follows.
    • Assume that you have both the Cryptographic operations.Encrypt new and the Cryptographic operations.Register host privileges on each host. In that case, the virtual machine creation process enables encryption on host C. The encryption process enables host encryption mode on host C, and pushes the key to each host in the cluster.

      For this case, you can also explicitly enable host encryption on host C.

    • Assume that you have only Cryptographic operations.Encrypt new privileges on the virtual machine or virtual machine folder. In that case, virtual machine creation succeeds and the key becomes available on host A and host B. Host C remains disabled for encryption and does not have the virtual machine key.
  • If none of the hosts has encryption enabled, and you have Cryptographic operations.Register host privileges on host A, then the virtual machine creation process enables host encryption on that host. Otherwise, an error results.
  • You can also use the vSphere API to set the encryption mode of a cluster to "force enable." Force enable causes all hosts in the cluster to be cryptographically "safe," that is, vCenter Server has installed a host key on the host. See vSphere Web Services SDK Programming Guide.

Disk Space Requirements

When you encrypt an existing virtual machine, you need at least twice the space that the virtual machine is currently using.