rw-r-r-T 1 root root 0 Aug 24 02:38 vsan_kms_castore_old.pem rw-r-r-T 1 root root 2726 Aug 24 02:30 vsan_kms_castore.pem Here is how you can compare and confirm if we have the right certificates and keys on the respective files we have on the hosts. If the server cert has been changed and does not match what ESXi has stored here, the connection will not be established. The vsan_kms_castore.pem file is a copy of the server certificate that the host uses to compare with the cert returned by the KMIP server during initial SSL handshake. Navigate to the path /etc/vmware/ssl on one of the hosts which is part of the vSAN-encrypted cluster and check the certificates on the files vsan_kms_client.crt (client Certificate) , vsan_kms_client.key (private key)and vsan_kms_castore.pem. Confirm if we have the right KMIP certificates vsan/kmipClusterId = the above output we see that we have two KMS server configuration pushed from VC to Hosts which are “” and “” and port used for connecting to KMS is 5696. vsan/kmipServer/child/name = 'hyt-primary' vsan/kmipServer/child/kmskey = 'vSAN-Encryption/hyt-primary' vsan/kmipServer/child/kmskey = 'vSAN-Encryption/hyt-Secondary' vsan/kmipServer/child/kmipClusterId = 'vSAN-Encryption' vsan/kmipServer/child/name = 'hyt-Secondary' It is okay to have VC down in all scenario as long as the KMS is reachable for the host. Take a look the file “esx.conf” which should be under /etc/vmware/ and grep kmip to view KMS configuration on the ESXi host if the KMS was configured with FQDN, then it is necessary for the host to be able to resolve the KMS server thru its FQDN. Content for checklist is available here at : ChecklistĪs discussed in the previous introduction blog, it is highly critical to note that the KMS server should NOT be deployed on the same cluster which is being encrypted which will lead to a catch-22 situation.

I have also included certain test-case scenario to see how the logging looks on the host when there is an issue with vSAN-encryption. This blog should give you a general approach towards troubleshooting problems with vSAN-encryption and also be able to look at a specific log location in order to isolate and fix a specific problem. I highly encourage you to check out my previous blog to understand how vSAN encryption works before you jump into troubleshooting problems with vSAN and a KMS server.

Get kms host key