This seemed like the most appropriate place to ask this question so here it goes:
I used to run a process that automatically generated a shim.key
and shim.crt
along with a ca.crt
for safe boot signing. Using the shim
versions I signd a file like this:
sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign
to verify the file I used the ca.crt
file like this:
sbverify --cert path/to/ca.crt filetosign.signed
All worked okay. But trying to verify using shim.crt
, as shown below, would would fail:
sbverify --cert path/to/shim.crt filetosign.signed
The updated process no longer generates the shim.key
, shim.crt
or ca.crt
files automatically, I have to provide it the shim.crt
. Looking at the script file I created last year, it appears that I first tried using efikeygen
but it must not have worked because it's commented out; I don't recall what the problem was and there are no notes in the script. Instead I set it up to create the new shim.key
and shim.crt
file using openssl:
openssl req -newkey rsa:2048 -x509 -sha256 -days 3650 -nodes -out shim.crt -keyout shim.key -subj "/CN=Acme UEFI SB 2020/O=Acme Inc/L=New York/ST=New York/C=US" openssl pkcs12 -export -out shim.pfx -inkey shim.key -in shim.crt openssl x509 -outform der -in shim.crt -out shim.cer
That gave me a shim.key
and shim.crt
file, but no ca.crt
file.
I can successfully sign and verify a file as follows:
sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign sbverify --cert path/to/shim.crt filetosign.signed
It gets confusing with all the different formats and terms used.
So a couple of questions:
Why would the original method, that created a
ca.crt
, not verify using theshim.crt
, but the new one without theca.crt
did?How could I create a
shim.key
,shim.crt
andca.crt
that would work like it originally did?
TIA!!
But trying to verify using shim.crt, as shown below, would would fail: sbverify --cert path/to/shim.crt filetosign.signed
- Please let us know what is the error message with which it fails? $\endgroup$ – user93353 Feb 26 at 1:05