STIGQter: STIG Summary: VMware vSphere 8.0 ESXi Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The ESXi host must use DOD-approved encryption to protect the confidentiality of network sessions.

DISA Rule

SV-265974r1003578_rule

Vulnerability Number

V-265974

Group Title

SRG-OS-000033-VMM-000140

Rule Version

ESXI-80-000247

Severity

CAT II

CCI(s)

CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.

Weight

Fix Recommendation

TLS Profiles can be configured with vSphere Configuration Profiles or manually on each host for clusters not using vSphere Configuration Profiles.

For ESXi hosts in clusters managed with vSphere Configuration Profiles do the following:

Note: These steps assume a vSphere Configuration Profile is already in use for the target cluster.

From the vSphere Client, go to Host and Clusters.

Select the vCenter Server >> Select the target cluster >> Configure >> Desired State >> Configuration >> Draft.

Click "Create Draft" or "Import from Host" if a draft does not exist.

Select system >> tls_server >> Configure Settings.

Select "NIST_2024" from the drop down for profile and click "Save".

Click "Apply Changes" and run through the pre-check to enforce the change.

Note: Updating this setting through a vSphere Configuration Profile will place hosts into maintenance mode and perform a rolling reboot of all hosts in the cluster.

For standalone hosts or clusters not managed with vSphere Configuration Profiles do the following:

Prior to changing the TLS profile it is highly recommended to place the host in maintenance mode.

From an ESXi shell, run the following command:

# esxcli system tls server set -p NIST_2024

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.tls.server.set.CreateArgs()
$arguments.profile = "NIST_2024"
$esxcli.system.tls.server.set.invoke($arguments)

A reboot is required to complete the process of changing profiles.

Check Contents

From an ESXi shell, run the following command:

# esxcli system tls server get --show-profile-defaults --show-current-boot-profile

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.tls.server.get.CreateArgs()
$arguments.showprofiledefaults = $true
$arguments.showcurrentbootprofile = $true
$esxcli.system.tls.server.get.invoke($arguments)

Example result:

Profile: NIST_2024
Cipher List: ECDHE+AESGCM
Cipher Suite: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
Groups: prime256v1:secp384r1:secp521r1
Protocol Versions: tls1.2,tls1.3
Reboot Required: true

If the TLS profile is not set to "NIST_2024" or is not the current boot profile, this is a finding.

Vulnerability Number

V-265974

Documentable

False

Rule Version

ESXI-80-000247

Severity Override Guidance

Check Content Reference

Target Key

5562