topic Re: Does ESXi secure boot specifically require a TPM chip? in VMware vSphere™ Discussions

Does ESXi secure boot specifically require a TPM chip?

markey165 — Sun, 10 Sep 2023 01:24:58 GMT

Hi experts, sorry if this is an obvious question.

As per question, does ESXi secure boot specifically require a TPM chip? I kind of think the answer is no, but i can't definitively find an answer to this. The documentation talks about being able to securely store the private key in a TPM chip, but doesn't make clear if the it is an absolute requirement?

My suspicion is that the private key may otherwise be stored in an NVRAM part of the UEFI chip, and that the TPM is simply a more secure alternative, but i can't validate this. Can anyone confirm?

Many Thanks

Re: Does ESXi secure boot specifically require a TPM chip?

maksym007 — Sun, 10 Sep 2023 13:13:30 GMT

TPM modul is for something different.

For secure boot mostly uefy setting are used

Re: Does ESXi secure boot specifically require a TPM chip?

battybishop — Sun, 10 Sep 2023 13:16:30 GMT

Secure boot does not require a TPM module and is part of the UEFI firmware standard.

Check out this VMware doc link

UEFI Secure Boot for ESXi Hosts (vmware.com)

Re: Does ESXi secure boot specifically require a TPM chip?

markey165 — Sun, 10 Sep 2023 13:57:57 GMT

@battybishop wrote:
Secure boot does not require a TPM module and is part of the UEFI firmware standard.
Check out this VMware doc link
UEFI Secure Boot for ESXi Hosts (vmware.com)

Thanks Rob, I read that very article, but it wasn't clear from the TPM reference, if it was optional or required, or where it stores the private key if a TPM chip isn't present. I couldn't really find that documented anywhere.

Thanks for confirming my suspicions though