How to enroll fedora public key to uefi?

Ask Fedora
, ,
12

I have managed to add fedora’s public key to uefi db list successfully. All I had do to is sign the fedora’s public key with my private keys and enroll it. It was easy, I already knew this before coming here but I asked here to confirm the procedure.

Thanks to those people who are just asking questions like “why do you want that” “why don’t you trust microsoft?” and sounding like impossible thing to do. :rofl:


sudo dmesg | grep "Loaded X.509 cert"
[sudo] password for arun: 
[    0.609839] Loaded X.509 cert 'Fedora kernel signing key: 002dde36c7912ca45a865597ba9330417b11b286'
[    0.654093] integrity: Loaded X.509 cert 'Home: Arun Signature Database: 3d669ad5bf370ac4a5f5d8508f795ccfaa09d9bc'
[    0.654325] integrity: Loaded X.509 cert 'Fedora Secure Boot CA: fde32599c2d61db1bf5807335d7b20e4cd963b42'
[    0.656765] Loaded X.509 cert 'Fedora kernel signing key: 002dde36c7912ca45a865597ba9330417b11b286'
[    7.032718] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'

❯ efi-readvar -v db                              
Variable db, length 2040
db: List 0, type X509
    Signature 0, size 1092, owner c1f3d934-bb2f-4b6f-a517-8f184b16d41e
        Subject:
            C=xx, ST=xxxx, L=xxxx, O=xxxx, CN=Arun Signature Database, emailAddress=no@email.com
        Issuer:
            C=xx, ST=xxxx, L=xxxx, O=xxxx, CN=Arun Signature Database, emailAddress=no@email.com
db: List 1, type X509
    Signature 0, size 892, owner 605dab50-e046-4300-abb6-3dd810dd8b23
        Subject:
            CN=Fedora Secure Boot CA
        Issuer:
            CN=Fedora Secure Boot CA
1 Like