The witness host appliance is provided by VMware in the form of an Open Virtualization Archive (OVA) that must reside on a physical ESXi host as a nested hypervisor. Contrary to a physical witness host, the witness host appliance does not consume a vSphere license to run. The witness host appliance must not reside on the same vSAN cluster for which it is providing services.