Chapter 6. Configuring RHEL on AWS with Secure Boot

Procedure

1. Check the platform status of the RHEL Marketplace AMI instance:

   $ sudo mokutil --sb-state

   SecureBoot disabled
   Platform is in Setup Mode

   The setup mode allows updating the Secure Boot UEFI variables within the instance.

2. Generate a custom_db.cer custom certificate:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout custom_db.key \
   -new -x509 -sha256 \
   -days 3650 \
   -subj "/CN=Signature Database key/" \
   --outform DER -out custom_db.cer

3. Generate UEFI variables file by using the virt-fw-vars utility:

   $ virt-fw-vars --enroll-redhat \
   --add-db-cert OvmfEnrollDefaultKeys custom_db.cer \
   --set-dbx /usr/share/edk2/ovmf/DBX* \
   --output-auth .

   For details, see the virt-fw-vars(1) man page on your system.

4. Convert UEFI variables to the Extensible Firmware Interface (EFI) Signature List (ESL) format:

   $ for f in PK KEK db dbx; do tail -c +41 $f.auth > $f.esl; done

   Note

   Each GUID is an assigned value and represents an EFI parameter

   • 8be4df61-93ca-11d2-aa0d-00e098032b8c: EFI_GLOBAL_VARIABLE_GUID
   • d719b2cb-3d3a-4596-a3bc-dad00e67656f: EFI_IMAGE_SECURITY_DATABASE_GUID

   The EFI_GLOBAL_VARIABLE_GUID parameter maintains settings of the bootable devices and boot managers, while the EFI_IMAGE_SECURITY_DATABASE_GUID parameter represents the image security database for Secure Boot variables db, dbx, and storage of required keys and certificates.

5. Transfer the database certificates to the target instance, use the efivar utility to manage UEFI environment variables.

   1. To transfer PK.esl, enter:

      $ sudo efivar -w -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-PK -f PK.esl

   2. To transfer KEK.esl, enter:

      $ sudo efivar -w -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-KEK -f KEK.esl

   3. To transfer db.esl, enter:

      $ sudo efivar -w -n d719b2cb-3d3a-4596-a3bc-dad00e67656f-db -f db.esl

   4. To transfer the dbx.esl UEFI revocation list file for x64 architecture, enter:

      $ sudo efivar -w -n d719b2cb-3d3a-4596-a3bc-dad00e67656f-dbx -f dbx.esl

6. Reboot the instance from the AWS console.

Procedure

1. Generate a custom certificate custom_db.cer:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout custom_db.key \
   -new -x509 -sha256 \
   -days 3650 -subj "/CN=Signature Database key/" \
   --outform DER -out custom_db.cer

2. Use the virt-fw-vars utility to generate the aws_blob.bin binary file from keys, database certificates, and the UEFI variable store:

   $ virt-fw-vars --enroll-redhat \
   --add-db-cert OvmfEnrollDefaultKeys custom_db.cer \
   --set-dbx /usr/share/edk2/ovmf/DBX* \
   --output-aws aws_blob.bin

   The customized blob consists of:

   • PK.cer, KEK.cer, db, and dbx from the edk2-ovmf package
   • The custom_db.cer generated certificate

3. Use the awscli2 utility to create and register the AMI from a disk snapshot with the required Secure Boot variables:

   $ aws ec2 register-image \
   --name rhel-9-secure-boot \
   --architecture x86_64 \
   --virtualization-type hvm \
   --root-device-name "/dev/sda1" \
   --block-device-mappings "{\"DeviceName\": \"/dev/sda1\",\"Ebs\": {\"SnapshotId\": \"<snap-02d4db3813ff9b98e>\"}}" \
   --ena-support --boot-mode uefi \
   --region eu-central-1 \
   --uefi-data $(cat aws_blob.bin)
   --output json

   {
       "ImageId": "example-amazon-id"
   }

4. Reboot the instance from the AWS Console.