Replies: 1 comment 10 replies
|
Since this is a question rather than an issue it's moved to discussions. You can build your own iPXE that trusts your CA with TRUST= as described at https://ipxe.org/crypto#trusted_root_certificates But if we scroll down to https://ipxe.org/crypto#externally_provided_certificates there is at least one more option. : So the workaround will required adding one certificate or other to the clients itself, and if you do that you might probably as well add trust for your own build of iPXE instead. But going back, using https to internal IP won't really do much? and in that case why not use DNS instead with publicly trusted certificate? |
|
Um, the Secure boot version of iPXE doesn't seem to have the |
Yes, that is correct. The reason for this is that without being able to specify a custom root of trust, there is limited value in having the command. Do you have a usage scenario in which you could sensibly use |
|
I understand. Redhat's |
The only way to get a custom root of trust with The whole point of UEFI Secure Boot is to disallow a custom root of trust. If you want to use a custom root of trust without doing either of the above options, then just disable UEFI Secure Boot. |
|
Okay, thanks for pushing back about Red Hat's |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I would like IPXE to able to
chain https://10.50.0.16/menu.ipxewhile still having Secure boot.I intuit that you can't use self-signed certificates with IPXE's Secure boot image, or is there a workaround?
I know Secure boot isn't really that important for security, but it is convenient to not have to go into the UEFI settings of every machine I'm provisioning to turn Secure boot off.
All reactions