Loading...
Loading...
Customers using custom Secure Boot keys should back up sbctl-managed key material before performing BIOS maintenance. If Secure Boot keys are no longer enrolled after a BIOS update, customers may be able to restore the saved key material and re-enroll the keys using sbctl.The commands shown in this document are based on the Ubuntu 24.04 sbctl environment used during validation and may require modification for customer-specific Secure Boot implementations.After a BIOS update and reboot, custom Secure Boot keys may no longer be enrolled in firmware. If this occurs, Operating System boot failures may occur because customer-signed EFI binaries can no longer be validated. Secure Boot may return to Setup Mode and remain disabled until the appropriate keys are re-enrolled.Potential Symptoms Following BIOS UpdateIf custom Secure Boot keys are no longer enrolled after the BIOS update, the impact is typically observed during the Linux boot process rather than during BIOS Power-On-Self-Test (POST).Systems may fail to boot the operating system because EFI bootloaders signed with the customer-managed Secure Boot keys can no longer be validated. Depending on the Operating System configuration, Secure Boot validation errors, bootloader signature verification failures, or repeated boot failures may be experienced prior to reaching the Linux login prompt.
Any HPE Compute XD690 platform with any BIOS version.
The following actions are recommended:Back up the sbctl-managed Secure Boot key material before the BIOS updateExecute the following commands:sudo mkdir -p /root/sbctl-backupsudo cp -a /var/lib/sbctl/keys /root/sbctl-backup/sudo cp -a /var/lib/sbctl/GUID /root/sbctl-backup/ 2>/dev/null || truesudo cp -a /var/lib/sbctl/files.* /root/sbctl-backup/ 2>/dev/null || truesudo chmod -R go-rwx /root/sbctl-backupNotes:The sbctl key material is normally stored under"/var/lib/sbctl/keys".The backup may contain private key material. Store it in a protected location and restrict access to authorized administrators only.Verify Secure Boot status using sbctl status after the BIOS updatePerform the following command to check the Secure Boot status:sudo sbctl statusdmesg | grep -i secureExpected Results:Healthy Secure Boot Configuration:Installed: sbctl is installed Setup Mode: Disabled Secure Boot: EnabledThe dmesg output should indicate that Secure Boot is enabled.Indicators that recovery or re-enrollment may be required:Setup Mode:Enabled Secure Boot: Disabledor messages indicating Secure Boot keys are not enrolled.Note:If Secure Boot is disabled or the platform has returned to Setup Mode after the BIOS update, Secure Boot keys may no longer be enrolled. Proceed with the key restoration and re-enrollment process described below.Note:If Secure Boot is disabled or the system has returned to Setup Mode, re-enrollment may be required.Recovery Access Requirement:If the Operating System cannot boot because Secure Boot key validation is failing, administrative access to the system may be required through an alternate recovery method.Examples may include temporarily disabling Secure Boot in BIOS Setup, booting from recovery media, or using another customer-approved recovery process.Once operating system access is restored, perform the backup restoration and key re-enrollment steps described below.If keys are no longer enrolled, restore the backup and re-enroll the appropriate Secure Boot keysIf the sbctl key material is missing or needs to be restored, copy the backed-up material back into the sbctl directory:sudo cp -a /root/sbctl-backup/keys /var/lib/sbctl/sudo cp -a /root/sbctl-backup/GUID /var/lib/sbctl/ 2>/dev/null || truesudo cp -a /root/sbctl-backup/files.* /var/lib/sbctl/ 2>/dev/null || trueNote:If the key material remains present under/var/lib/sbctl/keysafter the BIOS update, this restore step may not be required. In that case, proceed to key re-enrollment.Re-Enroll Secure Boot KeysRe-enroll the appropriate Secure Boot keys into firmware for your environment. Follow the Secure Boot key management process of your organization and enroll the required Platform Key (PK), Key Exchange Keys (KEK), and signature databases as needed. The enrollment method may vary depending on the Secure Boot implementation in use:sudo sbctl enroll-keysReboot the system:sudo rebootConfirm Secure Boot After RebootAfter reboot, confirm Secure Boot is enabled:sudo sbctl statusdmesg | grep -i secureExpected result after successful enrollment and reboot:Setup Mode: DisabledSecure Boot: EnabledInstallation of sbctl on systems running Ubuntu 24.04Use this section only if sbctl is not already installed on the system:Add the repository key:curl -fsSL \https://download.opensuse.org/repositories/home:/jloeser:/secureboot/xUbuntu_24.04/Release.key \| gpg --dearmor \| sudo tee /usr/share/keyrings/home_jloeser_secureboot.gpg > /dev/nullAdd the repository configuration:echo "deb [signed-by=/usr/share/keyrings/home_jloeser_secureboot.gpg] \ https://download.opensuse.org/repositories/home:/jloeser:/secureboot/xUbuntu_24.04/ /" \| sudo tee /etc/apt/sources.list.d/home_jloeser_secureboot.listUpdate package index and install sbctl:sudo apt update sudo apt install sbctlInitial Key Creation and EFI SigningUse this section when keys have not yet been created or the system requires initial Secure Boot setup.The following Commands are based on the Ubuntu 24.04 sbctl test environment used during validation:Create Secure Boot keys:sudo sbctl create-keysEnroll keys:sudo sbctl enroll-keysIdentify unsigned EFI binaries:sudo sbctl verifySign required EFI boot files. Example based on current Ubuntu testing:sudo sbctl sign -s /boot/efi/EFI/BOOT/BOOTX64.EFIsudo sbctl sign -s /boot/efi/EFI/BOOT/fbx64.efisudo sbctl sign -s /boot/efi/EFI/BOOT/mmx64.efisudo sbctl sign -s /boot/efi/EFI/ubuntu/grubx64.efisudo sbctl sign -s /boot/efi/EFI/ubuntu/mmx64.efisudo sbctl sign -s /boot/efi/EFI/ubuntu/shimx64.efi
Operating Systems Affected:Not Applicable
Click on a version to see all relevant bugs
Hewlett Packard Enterprise Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.