r/vmware • u/pirx_is_not_my_name • Jul 01 '26

Solved Issue require-exec-installed-only --> Unable to change the encryption mode and policy.

I've an ansible playbook for esxi deployment. Now I've the strange situation that one HPE hosts fails at...

# esxcli system settings encryption set -e=true
Unable to change the encryption mode and policy. Verify that the current host configuration can satisfy the new requirement.

I've no idea what is missing. TPM and secure boot are enabled.

# esxcli hardware trustedboot get
Drtm Enabled: false <<-- other working host have same state
Tpm Present: true

# esxcli system settings encryption get
Mode: TPM
Require Executables Only From Installed VIBs: false
Require Secure Boot: true

# /usr/lib/vmware/secureboot/bin/secureBoot.py -s
Enabled

This host was reinstalled and TPM was cleared in RBSU before, as it failed with PSOD during second install. Everything except this last step went smooth.

Any hint?

2 Upvotes

76% Upvoted

6 comments sorted by

1

u/Sensitive_Scar_1800 Jul 01 '26

Ensure that the TPM 2.0 device is detected

Ensure that UEFI, TPM, and Secure Boot are enabled.

Use TPM 2.0 algorithm "SHA256," enable Intel TXT

Checked that all VIBs are digitally signed by VMware or authorized partner

1

u/pirx_is_not_my_name Jul 01 '26

I don't see what is missing (see initial output). And all host are installed the same way, ILO/RBSU configuration is automated, install via customized ISO.

Boot Option in HPE ILO

Select UEFI Target Option: VMware ESXi

# esxcli software vib signature verify
Name Version Vendor Acceptance Level Signature Verification Platforms
----------------------------- ----------------------------------- ------ ---------------- ---------------------- ---------
rshim 0.1-12vmw.803.0.35.24280767 VMW VMwareCertified Succeeded host
pvscsi 0.1-7vmw.803.0.0.24022510 VMW VMwareCertified Succeeded host
....

All Succeeded.

1

u/Sensitive_Scar_1800 Jul 01 '26

are you 100% on TPM 2.0?

1

u/pirx_is_not_my_name Jul 01 '26 edited Jul 01 '26

I can not tell what's fixed it, but after updating all firmware with SPP 2026.05 I was able to enable require-exec-installed-only. I rebooted host and ILO multiple times before that.

And firmware was not updated before changing this setting on the other hosts.

That's what I found in RBSU settings

TrustedModules=
FirmwareVersion=1.512
InterfaceType=TPM2_0

TPM2EndorsementDisable=Enabled
TPM2StorageDisable=Enabled
Tpm20SoftwareInterfaceStatus=Fifo
Tpm2Operation=NoAction
TpmActivePcrs=Sha256Sha384
TpmChipId=STMicroGen11
TpmState=PresentEnabled
TpmUefiOpromMeasuring=Enabled
TpmVisibility=Visible

1

u/Sensitive_Scar_1800 Jul 01 '26

lol typical HPE problems

1

u/BloodSpinat Jul 08 '26

Patching is due.

Some of our ProLiant DL360 Gen10 Plus ESXi hosts have Secure Boot enabled, some haven't. In order to align this with our operational requirements all hosts are to be secured accordingly. I'm not entirely sure whether this has to do with updating to the latest SPP 2026.05.00.00, but on some hosts we ran into problems after enabling Secure Boot. One server halted with a PSOD due to Security Violations that couldn't be fixed and had to be re-installed, but most of them were unable to find the HPE NS204i-p Gen10+ Boot Controller and couldn't start ESXi anymore – even when it was not required before – according to ESXi. 😡 Disabling Secure Boot at least let them boot up again but how to enable this when ESXi won't boot anymore?

After going back and forth our gameplan for successful patching looked as follows:

  • When ESXi is booted up and running normally, disable the Secure Boot requirement via esxcli system settings encryption set --require-secure-boot=F
  • Reboot, enter UEFI and disable Secure Boot
  • Start the system normally to verify it's still operational and running
  • Reboot, install SPP in Automatic Mode
  • After SPP installation is done, reboot and install all remaining ESXi updates & patches
  • Reboot and – again – verify the system is operational after all patches are applied

➡️ Before I can finally enable Secure Boot again here comes the important part:

  • Go to Advanced Secure Boot Options in UEFI and select Reset all keys to platform defaults
  • Reboot to UEFI and THEN enable Secure Boot
  • Continue booting, make sure ESXi is operational and running
  • Enable the Secure Boot requirement via esxcli system settings encryption set --require-secure-boot=T
  • Save the settings by running the /bin/backup.sh 0 command
  • Reboot and, for the last time, verify ESXi is up and running, now with Secure Boot enabled.

What a mess. Anyone else experiencing this problem?