21.6. Generating a public and private key pair

Prerequisites

• You have root permissions on the system.

Procedure

• Create an X.509 public and private key pair.

  • If you only want to sign custom kernel modules:

    # efikeygen --dbdir /etc/pki/pesign \
                --self-sign \
                --module \
                --common-name 'CN=Organization signing key' \
                --nickname 'Custom Secure Boot key'

  • If you want to sign custom kernel:

    # efikeygen --dbdir /etc/pki/pesign \
                --self-sign \
                --kernel \
                --common-name 'CN=Organization signing key' \
                --nickname 'Custom Secure Boot key'

  • When the RHEL system is running FIPS mode:

    # efikeygen --dbdir /etc/pki/pesign \
                --self-sign \
                --kernel \
                --common-name 'CN=Organization signing key' \
                --nickname 'Custom Secure Boot key'
                --token 'NSS FIPS 140-2 Certificate DB'

    注記

    In FIPS mode, you must use the --token option so that efikeygen finds the default "NSS Certificate DB" token in the PKI database.

    The public and private keys are now stored in the /etc/pki/pesign/ directory. See the openssl(1) man page on your system for more information.