Chapter 5. Configuring RHEL on Azure with Secure Boot

Procedure

1. Generate a custom certificate custom_db.cer by using the openssl utility:

   $ openssl req -quiet \
   -newkey rsa:4096 \
   -nodes -keyout custom_db.key \
   -new -x509 \
   -sha256 -days 3650 \
   -subj "/CN=Signature Database key/" \
   --outform DER \
   -out custom_db.cer

2. Convert the certificate into base64-encoded format:

   $ echo base64 -w0 custom_db.cer
   
   MIIFIjCCAwqgAwIBAgITNf23J4k0d8c0NR ....

3. Create and edit an azure-example-template.json Azure Resource Manager (ARM) file for registering a new Azure Compute Gallery image version:

   $ vi azure-example-template.json
   
   {
       "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
       "contentVersion": "1.0.0.0",
       "resources": [
           {
               "type": "Microsoft.Compute/galleries/images/versions",
               "apiVersion": "2023-07-03",
               "name": "<your compute gallery/your image definition/version>",
               "location": "<location of the VHD>",
               "properties": {
                   "storageProfile": {
                       "osDiskImage": {
                           "source": {
                               "id": "<your-storage-account-id>",
                               "uri": "<url-with-the-vhd>"
                           },
                           "hostCaching": "ReadOnly"
                       }
                   },
                   "securityProfile": {
                       "uefiSettings": {
                           "signatureTemplateNames": [
                               "MicrosoftUefiCertificateAuthorityTemplate"
                           ],
                           "additionalSignatures": {
                               "db": [
                                   {
                                       "type": "x509",
                                       "value": [
                                           "<base64 of custom_db.cer>"
                                       ]
                                   }
                               ]
                           }
                       }
                   }
               }
           }
       ]
   }

4. Use the azure-cli utility to register the image version:

   $ az deployment group create --name <example-deployment> \
   --resource-group <example-resource-group> \
   --template-file <example-template.json>

5. Reboot the instance from the Azure Portal.

Verification

1. Check if the newly created RHEL instance has Secure Boot enabled:

   $ mokutil --sb-state
   SecureBoot enabled

2. Use the keyctl utility to verify the kernel keyring for the custom certificate:

   $ sudo keyctl list %:.platform
   
   keys in keyring:
   ...
   586621657: ---lswrv   0   0
   asymmetric: Signature Database key: f064979641c24e1b935e402bdbc3d5c4672a1acc
   ...