Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.futurex.com/llms.txt

Use this file to discover all available pages before exploring further.

Now that you set CryptoHub as a key provider in vCenter Server, vSphere users with the required privileges can create encrypted virtual machines and disks ( docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-431FDB2F-7F34-468D-9D6B-BC5E95279237.html). With those privileges, you can also do the following actions:
  • Encrypt existing virtual machines (
docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-5E2C3F74-38C1-44C3-ABC5-C2C9353B9DC4.html).
  • Decrypt encrypted virtual machines (
docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-3E65311F-996A-4D00-9991-D61A2B7FC3CA.html).
  • Add Virtual Trusted Platform Modules (vTPMs) to virtual machines (
docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-A43B6914-E5F9-4CB1-9277-448AC9C467FB.html). In addition to virtual machine encryption, you can encrypt data-in-transit for vSAN clusters and encrypt data-at-rest in vSAN datastores. This section demonstrates how to encrypt an existing virtual machine. Refer to the preceding VMware documentation links for instructions on performing the other encryption tasks that the vSphere CryptoHub KMIP integration enables.

​
Encrypt an existing virtual machine

You can encrypt existing virtual machines or virtual disks with the vSphere Client by changing their storage policy. However, you can only encrypt virtual disks for encrypted virtual machines.
Ensure that the virtual machine is powered off.
1
Log in to the vCenter Server system with the vSphere Client.
2
Right-click the virtual machine that you want to change and select VM Policies > Edit VM Storage Policies. You can set the storage policy for the virtual machine files, represented by VM home, and the storage policy for virtual disks.
3
Select the VM Encryption Policy in the drop-down list. Then, choose one of the following options:
  • To encrypt the VM and its hard disks, select an encryption storage policy and select [ OK ].
  • To encrypt the VM but not the virtual disks, toggle Configure per disk on, select the encryption storage policy for VM Home and other storage policies for the virtual disks, and select [ OK ].
4
You can also encrypt the virtual machine, or both virtual machine and disks, from the Edit Settings menu in the vSphere Client.
  1. Right-click the virtual machine and select Edit Settings.
  2. Go to the VM Options tab and open Encryption. Choose an encryption policy. If you deselect all disks, only the VM home is encrypted.
  3. Select [ OK ].
If the VM encryption operation succeeds, the task status displays as Completed.