Chapter 29. Enabling HTTPS boot encryption

Prerequisites

• You have root privileges on your system.
• You have an HTTPS server configured and serving signed kernel and initial RAM file system images.
• You have a CA certificate file available in the /etc/pki/ directory on your HTTPS server.
• Optional: You have a Dynamic Host Configuration Protocol (DHCP) server configured with a boot file option, or the HTTPS boot server URL is configured in the firmware.

Verification

• After the system reboots, the firmware starts the UEFI HTTPS boot process and downloads the boot image from the configured server.

Prerequisites

• You created a root CA signature list file in EFI signature list format with the .esl extension.
• You have root privileges on the host system.
• The virtual machine uses Open Virtual Machine Firmware (OVMF) with HTTPS boot support.

Procedure

• Load the CA certificate by using one of the following methods:

  • For QEMU, add the following parameter to the qemu-system-x86_64 command:

    # qemu-system-x86_64 <existing-qemu-options> -fw_cfg name=etc/edk2/https/cacerts,file=<path-to-root-ca>.esl

  • For libvirt, add the following XML inside the domain element of the virtual machine configuration:

    <qemu:commandline>
      <qemu:arg value='-fw_cfg'/>
      <qemu:arg value='name=etc/edk2/https/cacerts,file=<path-to-root-ca>.esl'/>
    </qemu:commandline>

    Important

    The name value must be etc/edk2/https/cacerts. This is how EDK2 identifies the root CA signature list.

Verification

• Start the virtual machine and confirm that UEFI HTTPS boot completes without a certificate trust error from the configured HTTPS server.