Enable HTTPS boot encryption

HTTPS boot encryption protects boot files in transit and authenticates the download server during network boot. Configure UEFI firmware to download the kernel and initial RAM file system (initramfs) over HTTPS with transport encryption and signature verification.

HTTPS boot encryption on RHEL
Copy link

HTTPS boot encryption downloads the kernel and initial RAM file system (initramfs) over HTTPS with transport encryption, digital signature verification, and server authentication before boot.

With firmware Transport Layer Security (TLS) support and trusted security certificates, you manage HTTPS boot encryption on your system. Digital signatures ensure boot file integrity and reliability before the firmware loads the downloaded image. The firmware must have decryption capabilities. Plain HTTP boot does not provide the same transport protection as HTTPS boot encryption.

You configure the CA certificate in client firmware in UEFI mode for UEFI HTTPS boot without a graphical interface.

Note

Each firmware vendor has its own procedure for enrolling certificates. Consult your firmware vendor documentation to enable HTTPS boot encryption.

Configure HTTPS boot encryption on TianoCore
Copy link

To enable UEFI HTTPS boot for the kernel and initial RAM file system (initramfs), configure OVMF or other TianoCore-based firmware to download them over HTTPS, set the boot source, enroll a Certificate Authority (CA) certificate, and put the UEFI HTTPS boot option first in the boot order.

Before you begin
Copy link

  • You have root privileges on your system.
  • You have an HTTPS server configured and serving signed kernel and initial RAM file system images.
  • You have a CA certificate file available in the /etc/pki/ directory on your HTTPS server.
  • Optional: You have a Dynamic Host Configuration Protocol (DHCP) server configured with a boot file option, or the HTTPS boot server URL is configured in the firmware.

Procedure
Copy link

  1. Restart the system and open the UEFI firmware settings:
    Note

    These steps provide separate instructions for physical hardware and for Open Virtual Machine Firmware (OVMF) virtual machines. Follow only the option that matches your platform.
    • On physical hardware, press the firmware setup key that your vendor documents at startup.
    • On a virtual machine with Open Virtual Machine Firmware (OVMF), press Esc at startup.
  2. Optional: On OVMF with the NT32 network simulator, start the NT32 simulator from the UEFI menu.
  3. Configure the boot source by using one of the following options:
    • When DHCP provides a boot file option, select UEFI HTTPv4 or UEFI HTTPv6 in Boot Manager. The firmware resolves the boot server URL from DHCP.
    • When DHCP is unavailable on a virtual machine with OVMF, open Device Manager > Network Device List > MAC:*<your-mac-address> > *HTTP Boot Configuration and enter the HTTPS boot server URL. The MAC address in the menu label matches your network adapter.
    • When DHCP is unavailable on physical hardware, configure the HTTPS boot server URL in the HTTP boot settings. Consult your firmware vendor documentation for the menu path.
  4. Open the certificate management settings in the UEFI firmware:
    • On physical hardware, open the certificate or truststore menu that your firmware vendor provides. This menu can be labeled Certificate Management, Trusted Certificates, or CA Certificates.
    • On a virtual machine with Open Virtual Machine Firmware (OVMF), open Device Manager > TLS Authentication Configuration > Server CA Configuration.
  5. Select the option to enroll a new certificate:
    • On physical hardware, select the option your firmware vendor provides, such as Add New Certificate.
    • On a virtual machine with Open Virtual Machine Firmware (OVMF), select Enroll Cert.

      The firmware shows the certificate enrollment interface.

  6. Add the CA certificate in the firmware interface:
    • On physical hardware, add the certificate by using manual input or certificate file upload from a connected USB drive as your firmware vendor provides.
    • On a virtual machine with Open Virtual Machine Firmware (OVMF), upload the CA certificate file from a connected USB drive. When prompted, enter the globally unique identifier (GUID) for the certificate file.

      The certificate file must be in Distinguished Encoding Rules binary format.

      When your certificate is in the Privacy-Enhanced Mail (PEM) text format, convert it to the Distinguished Encoding Rules (DER) format on the host system before you upload the file:

      # openssl x509 -in <ca-certificate>.pem -outform DER -out <ca-certificate>.der

      Follow the on-screen prompts to complete the upload. After the upload, the firmware displays the certificate details.

  7. Verify that the displayed certificate details match your CA certificate.
  8. Verify that UEFI HTTPS boot is enabled and set as the first entry in the boot order.
    Warning

    Incorrect UEFI settings can prevent the system from booting. Review your hardware documentation before you change firmware options.
  9. Save the UEFI firmware settings and exit.
  10. Reboot the system.

Results
Copy link

  • After the system reboots, the firmware starts the UEFI HTTPS boot process and downloads the boot image from the configured server.

Load the CA certificate for HTTPS boot
Copy link

Load the EFI signature list for the HTTPS boot CA certificate on Quick EMUlator (QEMU) or libvirt virtual machines when you do not enroll the certificate through the firmware interface.

Before you begin
Copy link

  • You created a root CA signature list file in EFI signature list format with the .esl extension.
  • You have root privileges on the host system.
  • The virtual machine uses Open Virtual Machine Firmware (OVMF) with HTTPS boot support.
Note

The signature list file contains your HTTPS boot Certificate Authority certificate in EFI Signature List format.

When the HTTPS server uses a CA certificate from the host truststore, run update-ca-trust on the host and use /etc/pki/ca-trust/extracted/edk2/cacerts.bin as the file in the fw_cfg parameter.

When you use a dedicated CA certificate, create an EFI signature list file with the .esl extension that contains only that certificate before you load it through fw_cfg.

Procedure
Copy link

Load the CA certificate by using one of the following methods:
  • For QEMU, add the following parameter to the qemu-system-x86_64 command: 
    # qemu-system-x86_64 <existing-qemu-options> -fw_cfg name=etc/edk2/https/cacerts,file=<path-to-root-ca>.esl
  • For libvirt, add the following XML inside the domain element of the virtual machine configuration: 
    <qemu:commandline>
  <qemu:arg value='-fw_cfg'/>
  <qemu:arg value='name=etc/edk2/https/cacerts,file=<path-to-root-ca>.esl'/>
</qemu:commandline>
    Important

    The name value must be etc/edk2/https/cacerts. This is how EDK2 identifies the root CA signature list.

Results
Copy link

  • Start the virtual machine and confirm that UEFI HTTPS boot completes without a certificate trust error from the configured HTTPS server.