This seemed like the most appropriate place to ask this question so here it goes:

I used to run a process that automatically generated a shim.key and shim.crt along with a ca.crt for safe boot signing. Using the shim versions I signd a file like this:

sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign

to verify the file I used the ca.crt file like this:

sbverify --cert path/to/ca.crt filetosign.signed

All worked okay. But trying to verify using shim.crt, as shown below, would would fail:

sbverify --cert path/to/shim.crt filetosign.signed

The updated process no longer generates the shim.key, shim.crt or ca.crt files automatically, I have to provide it the shim.crt. Looking at the script file I created last year, it appears that I first tried using efikeygen but it must not have worked because it's commented out; I don't recall what the problem was and there are no notes in the script. Instead I set it up to create the new shim.key and shim.crt file using openssl:

openssl req -newkey rsa:2048 -x509 -sha256 -days 3650 -nodes -out shim.crt -keyout shim.key -subj "/CN=Acme UEFI SB 2020/O=Acme Inc/L=New York/ST=New York/C=US" 
openssl pkcs12 -export -out shim.pfx -inkey shim.key -in shim.crt 
openssl x509 -outform der -in shim.crt -out shim.cer

That gave me a shim.key and shim.crt file, but no ca.crt file.

I can successfully sign and verify a file as follows:

sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign
sbverify --cert path/to/shim.crt filetosign.signed

It gets confusing with all the different formats and terms used.

So a couple of questions:

  1. Why would the original method, that created a ca.crt, not verify using the shim.crt, but the new one without the ca.crt did?

  2. How could I create a shim.key, shim.crt and ca.crt that would work like it originally did?


  • $\begingroup$ But trying to verify using shim.crt, as shown below, would would fail: sbverify --cert path/to/shim.crt filetosign.signed - Please let us know what is the error message with which it fails? $\endgroup$
    – user93353
    Feb 26, 2021 at 1:05
  • 1
    $\begingroup$ It could be that the certificate is included in the file that you signed, and that you need to provide a CA certificate to verify the chain. These kind of questions are generally better asked on a Q/A site that is more specific to the problem though, because these tools may behave in rather application-specific ways (i.e. the problem isn't so much with the crypto, but the specific way that the program performs the crypto). We'd have to look into the sbsign / sbverify tools to find out... $\endgroup$
    – Maarten Bodewes
    Feb 27, 2021 at 17:12
  • $\begingroup$ Finally got in to system the issue is: PKCS7 verification failed 140232027154064:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:328:Verify error:unable to verify the first certificate $\endgroup$ Mar 2, 2021 at 3:41


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.