UEFI Secure Boot is configured on the ESX host.
RecoverPoint for VMs installation using the WDM fails at the step for deploying the splitter on the ESX host.
Error on the ESX host upon deploying the splitter:
"Could not stage image profile '(Updated) ESXi-6.5.0-2018050xxx-standard': ('EMC_Recoverpoint_bootbank_RP-Splitter_RPESX-00.5.1.1.5.0.d.xxx.000', "('EMC_Recoverpoint_bootbank_RP-Splitter_RPESX-00.5.1.1.5.0.d.xxx.000', 'The VIB EMC_Recoverpoint_bootbank_RP-Splitter_RPESX-00.5.1.1.5.0.d.xxx.000 does not contain a signature.')")"" reporting on the VC tasks.
Error on the ESX host in "/var/log/esxupdate":
2018-11-27T19:11:19Z esxupdate: 2102562: Transaction: WARNING: UEFI Secure Boot enabled: Cannot skip signature checks. Installing unsigned VIBs will prevent the system from booting. So the vib signature check will be enforced.
From /files/home/kos/installationLogs/server.log:
2018-11-27 19:14:10,916 [pool-8-thread-1] (BaseAction.java:42) ERROR - DeployVibOnESXsUsingDatastoreAction Failed.
com.emc.recoverpoint.connectors.actions.infra.ActionFailedException: Failed to install vib on 4 Failures: {EsxUuid(super=Uuid(uuid=host-44))=ActionFailedException(super=com.emc.recoverpoint.connectors.actions.infra.ActionFailedException: Vib didn't appear on ESX after installation., faultCause=GENERAL_ERROR), EsxUuid(super=Uuid(uuid=host-35))=ActionFailedException(super=com.emc.recoverpoint.connectors.actions.infra.ActionFailedException: Vib didn't appear on ESX after installation., faultCause=GENERAL_ERROR), EsxUuid(super=Uuid(uuid=host-28))=ActionFailedException(super=com.emc.recoverpoint.connectors.actions.infra.ActionFailedException: Vib didn't appear on ESX after installation., faultCause=GENERAL_ERROR), EsxUuid(super=Uuid(uuid=host-71))=ActionFailedException(super=com.emc.recoverpoint.connectors.actions.infra.ActionFailedException: Vib didn't appear on ESX after installation., faultCause=GENERAL_ERROR)}
at com.emc.recoverpoint.connectors.actions.infra.ActionFailedException.createException(ActionFailedException.java:35) ~[vsphere_actions.jar:?]
at com.emc.recoverpoint.connectors.actions.deploy.DeploySplitterUsingDatastoreAction.perform(DeploySplitterUsingDatastoreAction.java:75) ~[vsphere_actions.jar:?]
In order for the RP splitter to install, it must allow the signature check. If UEFI Secure Boot is configured, signature check is not allowed and so the installation fails. This is detailed in the vSphere security docs:
"Secure boot is part of the UEFI firmware standard. With secure boot enabled, a machine refuses to load any UEFI driver or app unless the operating system bootloader is cryptographically signed. Starting with vSphere 6.5, ESXi supports secure boot if it is enabled in the hardware."
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-5D5EE0D1-2596-43D7-95C8-0B29733191D9.html
Workaround:
Disable UEFI Secure Boot.
The detailed process may change depending on the BIOS in use by the host, but macro steps are:
-
Reboot host and enter BIOS
-
Select the boot menu
-
Disable Secure boot
- Save bios changes and restart host