21.10. Signing a GRUB build with the private key

Prerequisites

• You have generated a public and private key pair and know the validity dates of your public keys. For details, see Generating a public and private key pair.
• You have enrolled your public key on the target system. For details, see Enrolling public key on target system by adding the public key to the MOK list.
• You have a GRUB EFI binary available for signing.

Procedure

• On the x64 architecture:

  1. Create a signed GRUB EFI binary:

     # pesign --in /boot/efi/EFI/redhat/grubx64.efi \
              --out /boot/efi/EFI/redhat/grubx64.efi.signed \
              --certificate 'Custom Secure Boot key' \
              --sign

     Replace Custom Secure Boot key with the name that you chose earlier.

  2. Optional: Check the signatures:

     # pesign --in /boot/efi/EFI/redhat/grubx64.efi.signed \
              --show-signature

  3. Overwrite the unsigned binary with the signed binary:

     # mv /boot/efi/EFI/redhat/grubx64.efi.signed \
          /boot/efi/EFI/redhat/grubx64.efi

     警告

     When overwriting the grub binary, your system might fail to boot normally and you might require reinstalling the grub from the system image.

• On the 64-bit ARM architecture:

  1. Create a signed GRUB EFI binary:

     # pesign --in /boot/efi/EFI/redhat/grubaa64.efi \
              --out /boot/efi/EFI/redhat/grubaa64.efi.signed \
              --certificate 'Custom Secure Boot key' \
              --sign

     Replace Custom Secure Boot key with the name that you chose earlier.

  2. Optional: Check the signatures:

     # pesign --in /boot/efi/EFI/redhat/grubaa64.efi.signed \
              --show-signature

  3. Overwrite the unsigned binary with the signed binary:

     # mv /boot/efi/EFI/redhat/grubaa64.efi.signed \
          /boot/efi/EFI/redhat/grubaa64.efi