Short answer: a vTPM needs a key provider, because vSphere encrypts the VM home files (including the .nvram that holds the vTPM state). For vTPM alone, the built-in vSphere Native Key Provider (NKP) is enough: no external key server, and it’s included in all vSphere editions. Add it under vCenter → Configure → Security → Key Providers, back it up right away (vSphere won’t use it until you do), then add the TPM device to a VM with EFI firmware and hardware version 14 or later. Use an external KMIP key server (standard key provider) when you need KMIP, an HSM, compliance controls, or keys that never stay on the hosts.
The three key provider types
| vSphere Native Key Provider | Standard key provider | Trusted key provider | |
|---|---|---|---|
| Key source | vCenter generates a Key Derivation Key (KDK) and pushes it to the hosts | External KMIP key server; vCenter fetches the keys and distributes them | vSphere Trust Authority; keys are released only to attested hosts |
| External key server | Not needed | Required | Required (behind Trust Authority) |
| Keys on the hosts | Written persistently to the hosts in the cluster | Key server must be reachable for encrypted VMs | Key server must be reachable |
| Host TPM 2.0 | Optional; can be enforced (“use key provider only with TPM protected ESXi hosts”) | Not required | Required on the trusted hosts |
| Best for | vTPM for Windows 11 / VBS, labs, sites without a KMS | VM Encryption and vSAN encryption with compliance, KMIP or HSM needs | High-assurance environments with attestation |
Licensing: Broadcom’s vSphere 8 documentation states that NKP and vTPM are included in all vSphere editions, while VM Encryption with NKP needs vSphere Enterprise Plus. On VVF and VCF 9, check your entitlement for VM Encryption and vSAN encryption. To see which provider an existing VM uses, see Which key provider is a VM using?
Set up a vSphere Native Key Provider
- In the vSphere Client select the vCenter, then Configure → Security → Key Providers → Add → Add Native Key Provider.
- Give it a name that is unique across all key providers of every type. vSphere treats two providers with the same name as the same provider.
- Optionally check Use key provider only with TPM protected ESXi hosts. Then only hosts with a TPM 2.0 receive the key, and VMs that need it can’t start on hosts without one.
- Select the new provider and click Back Up. Protect the PKCS#12 file with a password and store both in your vault, not on a datastore of the same vCenter. The Not backed up status on the provider then clears.
The backup is not optional. Broadcom’s documentation says you must back up an NKP before you can use it, and a vCenter file-based backup is not a substitute for it. Without the PKCS#12 file, a rebuilt vCenter can’t decrypt the VMs that depend on the provider.
Add a vTPM to a VM
- Requirements: EFI firmware, VM hardware version 14 or later, and a key provider that shows as available in vCenter. Windows guests need vCenter 6.7 or later, Linux guests 7.0 U2 or later.
- New VM: in the New Virtual Machine wizard, under Customize hardware, choose Add New Device → Trusted Platform Module.
- Existing VM: power it off, check that it boots with EFI (switching an installed OS from BIOS to EFI usually breaks booting), then Edit Settings → Add New Device → Trusted Platform Module.
- Option missing? The VM uses BIOS firmware, its hardware version is below 14, or vCenter has no usable key provider (Broadcom KB 413610).
Only the VM home files are encrypted for a vTPM. The disks stay unencrypted unless you also apply a VM encryption storage policy.
Traps to know before you roll out vTPM
- Backups must include the .nvram file. A VM backup without it restores a VM whose vTPM is gone. The key provider must also be available where you restore.
- Cloning: a clone can either copy the vTPM (same secrets and identity) or replace it with a new, blank vTPM. Replacing it also replaces workload keys such as BitLocker protectors, so check what the guest uses first.
- Physical security with NKP: the key is stored on the hosts. If someone can take a host away, consider a standard or trusted key provider, which need the key server online to unlock VMs.
- Retiring a provider: rekey every VM and disk to the new provider first, then confirm no VM still refers to the old name. The PowerCLI inventory for that is in Which key provider is a VM using?
- Windows 11 and Secure Boot: a vTPM pairs with EFI Secure Boot. The Microsoft UEFI CA 2011 certificates in VMs expire in 2026, see Microsoft UEFI Secure Boot certificate expiration in vSphere VMs.
Sources
- Broadcom TechDocs: vSphere Native Key Provider overview
- Broadcom TechDocs: Back up a vSphere Native Key Provider
- Broadcom TechDocs: Comparison of vSphere key providers
- Broadcom TechDocs: What is a virtual Trusted Platform Module
- Broadcom KB 413610: vTPM option missing when adding a new device
