Information
A VIB (vSphere Installation Bundle) is a collection of files that are packaged into an archive. The VIB contains a signature file that is used to verify the level of trust. The ESXi Image Profile supports four VIB acceptance levels:
VMware Certified - VIBs created, tested, and signed by VMware
VMware Accepted - VIBs created by a VMware partner but tested and signed by VMware
Partner Supported - VIBs created, tested, and signed by a certified VMware partner
Community Supported - VIBs that have not been tested by VMware or a VMware partner
Rationale:
The ESXi Image Profile should only allow signed VIBs because an unsigned VIB represents untested code installed on an ESXi host. Also, use of unsigned VIBs will cause hypervisor Secure Boot to fail to configure. Community Supported VIBs do not have digital signatures. To protect the security and integrity of your ESXi hosts, do not allow unsigned (CommunitySupported) VIBs to be installed on your hosts.
Solution
To implement the recommended configuration state, run the following PowerCLI command (in the example code, the level is Partner Supported):
# Set the Software AcceptanceLevel for each host<span>
Foreach ($VMHost in Get-VMHost ) {
$ESXCli = Get-EsxCli -VMHost $VMHost
$ESXCli.software.acceptance.Set('PartnerSupported')
}
Default Value:
Partner Supported
References:
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-52188148-C579-4F6A-8335-CFBCE0DD2167.html