21.9. Signing a kernel with the private key

Prerequisites

• You have generated a public and private key pair and know the validity dates of your public keys. For details, see Generating a public and private key pair.
• You have enrolled your public key on the target system. For details, see Enrolling public key on target system by adding the public key to the MOK list.
• You have a kernel image in the ELF format available for signing.

Procedure

• On the x64 architecture:

  1. Create a signed image:

     # pesign --certificate 'Custom Secure Boot key' \
              --in vmlinuz-version \
              --sign \
              --out vmlinuz-version.signed

     Replace version with the version suffix of your vmlinuz file, and Custom Secure Boot key with the name that you chose earlier.

  2. Optional: Check the signatures:

     # pesign --show-signature \
              --in vmlinuz-version.signed

  3. Overwrite the unsigned image with the signed image:

     # mv vmlinuz-version.signed vmlinuz-version

• On the 64-bit ARM architecture:

  1. Decompress the vmlinuz file:

     # zcat vmlinuz-version > vmlinux-version

  2. Create a signed image:

     # pesign --certificate 'Custom Secure Boot key' \
              --in vmlinux-version \
              --sign \
              --out vmlinux-version.signed

  3. Optional: Check the signatures:

     # pesign --show-signature \
              --in vmlinux-version.signed

  4. Compress the vmlinux file:

     # gzip --to-stdout vmlinux-version.signed > vmlinuz-version

  5. Remove the uncompressed vmlinux file:

     # rm vmlinux-version*