security - openSUSE shim certificate for uefi secure boot -
is opensuse shim bootloader signed opensuse private key? if so, can find corresponding opensuse certificate secure boot verification purpose?
a public key can retrieved shim source package:
- download http://download.opensuse.org/source/distribution/13.1/repo/oss/suse/src/shim-0.2-3.1.src.rpm
- extract using e.g.: rpm2cpio shim-0.2-3.1.src.rpm | cpio -dium
- unpack tar-ball inside: tar-xjf shim-12.3-update.tar.xz
the certificate can found in usr/lib64/efi subdir: openssl x509 -inform der -in usr/lib64/efi/shim-opensuse.der -text
certificate: data: version: 3 (0x2) serial number: 1 (0x1) signature algorithm: sha256withrsaencryption issuer: cn=opensuse secure boot ca, c=de, l=nuremberg, o=opensuse project/emailaddress=build@opensuse.org
you can verify 2nd stage bootloaders , kernels using sbverify sbsigntool package (that's called on ubuntu)
Comments
Post a Comment