Following preliminaries:

  • Linux 4.2.3-gentoo
  • GRUB2
  • UEFI, Secure Boot off

Now, I want to mess with the secure boot so I'm able to turn it on. More or less following this guide, I have:

  1. backed up the default keys from MS:

    #efi-readvar -v PK -o old_PK.esl
    #efi-readvar -v KEK -o old_KEK.esl
    #efi-readvar -v db -o old_db.esl
    #efi-readvar -v dbx -o old_dbx.esl
  2. generated my own keys:

    #openssl req -new -x509 -newkey rsa:2048 -subj "/CN=my platform key/" -keyout PK.key -out PK.crt -days 3650 -nodes -sha256
    #openssl req -new -x509 -newkey rsa:2048 -subj "/CN=my key exchange key/" -keyout KEK.key -out KEK.crt -days 3650 -nodes -sha256
    #openssl req -new -x509 -newkey rsa:2048 -subj "/CN=my kernel signing key/" -keyout db.key -out db.crt -days 3650 -nodes -sha256
    #cert-to-efi-sig-list -g "$(uuidgen)" PK.crt PK.esl
    #sign-efi-sig-list -k PK.key -c PK.crt PK PK.esl PK.auth
  3. cleared the keys in BIOS so efi-readvar outputs no keys on reboot

  4. set the backed up keys back and appended mine:

    #efi-updatevar -e -f old_KEK.esl KEK
    #efi-updatevar -e -f old_db.esl db
    #efi-updatevar -e -f old_dbx.esl dbx
    #efi-updatevar -a -c KEK.crt KEK
    #efi-updatevar -a -c db.crt db
    #efi-updatevar -f PK.auth PK
  5. signed the bootloader:

    #cp /boot/EFI/grub/grubx64.efi /boot/EFI/grub/grubx64.efi.old
    #sbsign --key db.key --cert db.crt --output /boot/EFI/grub/grubx64.efi /boot/EFI/grub/grubx64.efi

The verification runs through:

#sbverify --cert db.crt /boot/EFI/grub/grubx64.efi
 Signature verification OK.

Still, when I turn secure boot on in BIOS and reboot, the usual error message is displayed and GRUB is not invoked as if it was not signed. What do I miss?

  • Are you using OVMF on KVM or its a baremetal setup? – shubham Dec 15 '15 at 8:28
  • Non, no vrtualization at all. Unfortunately, I moved to booting up the kernel directly from UEFI (EFI stub), so I got rid of GRUB anyway now. – hoefling Dec 15 '15 at 12:25
  • Can you check your signatures with pesign? It will let you know if the keys are signed with your certificates. Moreover you should check your certificate db using certutil – shubham Dec 16 '15 at 7:01
  • You're right, there's obviously something wrong here. pesign gives me the error: "Could not initialize nss: The certificate/key database is in an old, unsupported format." And certutil -L -d $efidir outputs: "certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format." I have no clue what to do now, since I try to keep the system up to date, is it an issue with my hardware? – hoefling Dec 17 '15 at 20:21
  • I dont think it is a hardware issue. Can you try adding your newly generated keys in certificate database? Following link will be helpful for this : en.opensuse.org/openSUSE:UEFI_Image_File_Sign_Tools NOTE: I suggest to follow complete steps (starting from key generation). I have successfully used this to generate keys for myself – shubham Dec 18 '15 at 6:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.