# What is the difference of having to use a ca.crt to verify a signed file vs the .crt used to sign it?

This seemed like the most appropriate place to ask this question so here it goes:

I used to run a process that automatically generated a shim.key and shim.crt along with a ca.crt for safe boot signing. Using the shim versions I signd a file like this:

sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign

to verify the file I used the ca.crt file like this:

sbverify --cert path/to/ca.crt filetosign.signed

All worked okay. But trying to verify using shim.crt, as shown below, would would fail:

sbverify --cert path/to/shim.crt filetosign.signed

The updated process no longer generates the shim.key, shim.crt or ca.crt files automatically, I have to provide it the shim.crt. Looking at the script file I created last year, it appears that I first tried using efikeygen but it must not have worked because it's commented out; I don't recall what the problem was and there are no notes in the script. Instead I set it up to create the new shim.key  and shim.crt file using openssl:

openssl req -newkey rsa:2048 -x509 -sha256 -days 3650 -nodes -out shim.crt -keyout shim.key -subj "/CN=Acme UEFI SB 2020/O=Acme Inc/L=New York/ST=New York/C=US"
openssl pkcs12 -export -out shim.pfx -inkey shim.key -in shim.crt
openssl x509 -outform der -in shim.crt -out shim.cer


That gave me a shim.key and shim.crt file, but no ca.crt file.

I can successfully sign and verify a file as follows:

sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign
sbverify --cert path/to/shim.crt filetosign.signed


It gets confusing with all the different formats and terms used.

So a couple of questions:

1. Why would the original method, that created a ca.crt, not verify using the shim.crt, but the new one without the ca.crt did?

2. How could I create a shim.key, shim.crt and ca.crt that would work like it originally did?

TIA!!

• But trying to verify using shim.crt, as shown below, would would fail: sbverify --cert path/to/shim.crt filetosign.signed - Please let us know what is the error message with which it fails? – user93353 Feb 26 at 1:05
• It could be that the certificate is included in the file that you signed, and that you need to provide a CA certificate to verify the chain. These kind of questions are generally better asked on a Q/A site that is more specific to the problem though, because these tools may behave in rather application-specific ways (i.e. the problem isn't so much with the crypto, but the specific way that the program performs the crypto). We'd have to look into the sbsign / sbverify tools to find out... – Maarten Bodewes Feb 27 at 17:12
• Finally got in to system the issue is: PKCS7 verification failed 140232027154064:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:328:Verify error:unable to verify the first certificate – user3161924 Mar 2 at 3:41