I am trying to do what I think is a pretty standard setup of encrypted /
partition and unencrypted /boot
using the Debian installer (for Stretch-rc1). I created /boot
by selecting the option EFI System Partition
, as this is a UEFI system. I then created an encrypted LUKS volume and put the root file system there. Although all this was done with the installer, the GPT and the unformatted partitions were first created with fdisk.
When I try to finish writing the changes to disk, I get an error:
Encryption configuration failure
You have selected the root file system to be stored on an encrypted partition. This feature requires a separate /boot partition on which the kernel and initrd can be stored. You should go back and setup a /boot partition.
I am confused because I did this earlier without the encryption and everything worked fine. Looking at the ESP /boot
partition shows the bootable flag is on. Perhaps I have a fundamental misunderstanding of what Debian wants to do with the ESP? I welcome any suggestions to get this working.