VMware vSphere Encryption: The KMS Server for VM, vTPM and vSAN

vSphere can encrypt virtual machines, virtual TPMs and vSAN datastores. The usual search, "KMS server for VMware encryption" or "vSphere KMS", is about where that key comes from. vCenter does not have to generate it itself. It can use an external key manager over KMIP, registered as a KMS cluster.

DuoKey is that external key manager. Cockpit's KMIP listener is the KMS cluster. vCenter creates and registers an AES-256 key there. The key stays in the DuoKey vault. (DuoKey docs: VMware VM encryption)

---

Table of Contents

1. Standard key provider and Native Key Provider
2. What the DuoKey KMS cluster protects
3. How vCenter is onboarded
4. How the key is stored
5. What you still do in vCenter
6. FAQ

---

Standard key provider and Native Key Provider

vSphere has two different key providers. They are easy to mix up because both appear under Configure, Key Providers.

DuoKey follows the external path. The onboarding commands are govc crypto.kms.add and govc crypto.kms.trust, which register a KMS cluster. vSphere Client shows the same workflow under Key Providers as adding a standard key provider. A Native Key Provider that never leaves vCenter is a separate vSphere feature, and it does not call DuoKey. (DuoKey docs: VMware VM encryption)

---

What the DuoKey KMS cluster protects

One KMS cluster can back encryption for many targets. You list the clusters, datastores or VMs as policy targets. You do not create a separate integration per VM.

The connection is KMIP (binary TTLV) over mutual TLS. The default port is 5696. vCenter is the KMIP client. Cockpit's KMIP listener is the server. (DuoKey docs: VMware VM encryption, DuoKey docs: KMIP)

---

How vCenter is onboarded

There is no wizard that reaches into vCenter. In Cockpit you record the vCenter endpoint, an optional datacenter, the KMS cluster name, whether this cluster is the default for new encryption, the policy targets, the KMIP port, an optional rotation interval and the vault. The vault defaults to the tenant vault. DuoKey then generates a deployment bundle: KMIP host, port, the mutual-TLS certificate material, and the commands the vSphere administrator runs.

The published govc form is:

# 1. Add DuoKey's KMIP listener as a KMS cluster
govc crypto.kms.add -name=<kms-cluster-name> -address=<kmip-host> -port=<kmip-port>

# 2. Establish mutual trust
govc crypto.kms.trust -cert=<ca-cert-path> <kms-cluster-name>

# 3. Optional: mark as the default KMS cluster
govc crypto.kms.default <kms-cluster-name>

# 4. Confirm the cluster is trusted and active
govc crypto.kms.info <kms-cluster-name>

vCenter creates and registers the key when the encryption storage policy is applied. DuoKey activates it. Applying VM, vTPM or vSAN encryption is a vSphere operation against that trusted cluster. (DuoKey docs: VMware VM encryption)

Prerequisites from the same page:

• A vSphere version that supports an external key provider
• vCenter access to configure Key Providers
• A network path from vCenter to the KMIP listener on the configured port
• A DuoKey vault for the AES-256 key

---

How the key is stored

The KMIP server stores generated key material encrypted at rest with AES-256-GCM under the platform encryption key. That is envelope encryption. It is not MPC. MPC is a different DuoKey custody model, used for flows such as Microsoft 365 Double Key Encryption, and the KMIP documentation says so explicitly. (DuoKey docs: KMIP)

Client authentication on the listener is mutual TLS when you require it. In production the listener refuses to start until a client CA bundle is set. Without that bundle, presented certificates are not a trustworthy identity. (DuoKey docs: KMIP)

The KMIP server generates symmetric keys. It does not create RSA or EC key pairs. VM encryption on this path uses the AES-256 key vCenter registers.

---

What you still do in vCenter

Cockpit records which vCenter KMS cluster is bound to which key and which KMIP endpoint, and it generates the commands. It does not log into vCenter and apply storage policies. Trust status inside vCenter is the source of truth for whether the cluster is trusted and in use. Cockpit health checks report reachability, KMIP connectivity, whether trust is established in the stored configuration, whether the key is active, and a combined encryption indicator. Confirm the cluster in vCenter before you treat a workload as encrypted. (DuoKey docs: VMware VM encryption)

The same KMIP endpoint is what other DuoKey clients use. Database engines on KMIP are covered in SQL key management and database encryption. The integration entry is VMware vSphere and vSAN.

---

FAQ

What is a KMS server for VMware encryption?

An external key manager that vCenter calls over KMIP when it encrypts VMs, virtual TPMs or vSAN. In vSphere this is a standard key provider, registered as a KMS cluster. DuoKey Cockpit provides that listener.

Is DuoKey a vSphere Native Key Provider?

No. The Native Key Provider keeps keys inside vCenter and does not use an external KMS. DuoKey is the external KMS cluster on the standard key provider path.

Which port does vCenter use?

5696 by default, KMIP over mutual TLS. The port is set on the integration if you change it.

Does DuoKey apply the encryption policy for me?

No. The vSphere administrator adds the KMS cluster, establishes trust and applies the encryption storage policy. DuoKey supplies the key and the connection material.

Are these keys protected with MPC?

No. Keys on the KMIP server are envelope-encrypted under the platform key. See DuoKey KMIP.