I am trying to PXE boot with SecureBoot enabled. My PXE does boot with UEFI enabled, however when enabling SecureBoot I get the error “Boot failed. EFI Network. Failed Secure Boot Verification.”
My bootx64.efi in the tftp root looks like it it has the appropriate signing certificates.
root@hostname:/var/lib/tftpboot# sbverify --list bootx64.efi
warning: data remaining[830784 vs 955656]: gaps between PE/COFF sections?
signature 1
image signature issuers:
- /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
image signature certificates:
- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows UEFI Driver Publisher
issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation Third Party Marketplace Root
I’ve also tried to sign the bootx64.efi with my own key following the instructions here.
https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
I’ve tried using the grubnetx64.efi.dualsigned from the shim-signed package as well which has these certificates.
root@hostname:/var/lib/tftpboot# sbverify --list bootx64.efi
warning: data remaining[836848 vs 962400]: gaps between PE/COFF sections?
signature 1
image signature issuers:
- /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master Certificate Authority
image signature certificates:
- subject: /C=GB/ST=Isle of Man/O=Canonical Ltd./OU=Secure Boot/CN=Canonical Ltd. Secure Boot Signing (2022 v1)
issuer: /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master Certificate Authority
signature 2
image signature issuers:
- /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
image signature certificates:
- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows UEFI Driver Publisher
issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation Third Party Marketplace Root
When trying to boot to PXE, the client only requests the bootx64.efi from the TFTP server, meaning it doesn’t get to start loading the image that it should, doesn’t download grubx64.efi, nor do I get to a grub menu.
If I turn of SecureBoot it correctly downloads my grub/grub.cfg file and will load the PXE images.
I’d like this to work with SecureBoot so that we don’t have to turn it off when trying to load the PXE. Most of the instructions that I found for how to get SecureBoot to work are intended for getting it to work on a single machine and the instructions are difficult to adapt to using in a netboot environment. Any help you could give would be appreciated.
