Following the instructions here: Secure Boot - ArchWiki worked great last year (2016). However, any keys created since the start of 2017 are refused by my Dell Optiplex 7440's UEFI firmware.

I can even set the date on my desktop to 31st Dec 2016 and create a valid Platform Key, but anything created with a later date fails to upload in the Custom Mode Key Management section of the BIOS with:

Error replacing key. Please make sure that the new key is properly formatted with signature list and serialization headers.

Exactly the same commands are used as before, just the date on the computer used to generate the key has changed:

openssl req -newkey rsa:2048 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=Platform Key/" -out PK.crt
cert-to-efi-sig-list -g $uuid PK.crt PK.esl
sign-efi-sig-list -k PK.key -c PK.crt -g $uuid PK PK.esl PK.auth

Any ideas gratefully received. This also works/fails in the same way on a Fujitsu machine.


Aaargh - Ubuntu 16.04 version of efitools: 1.4.2. Latest version of efitools: 1.7.0. Problem solved!

  • 1
    Feel free to accept your own answer (otherwise your question still appears in the "unanswered" lists). – Stephen Kitt Jan 12 '17 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.