This procedure might brick your device. The contents are not yet fully verified and should not be used in any productive setup. Proceed with caution, you have been warned

If you are confused by the whole key nomenclature in UEFI, go and see this excellent blog post for a summary of the different UEFI key types.

I write this blog post as a draft/guide for some people to check and verify before putting this into a more official place. Please check before you type, make sure you understand what’s going on here. If you feel uneasy modifying a system on a UEFI level, then this guide is certainly not for you.

Caveats set in place, let’s get onto it

Secure boot with openSUSE keys only

In this guide we’ll be setting up a openSUSE Tumbleweed installation to only boot binaries that are signed with the provided openSUSE key. This means that you can then only boot openSUSE Linux. Not even Fedora or Debian will be accepted. Because if we already have secure boot … why not use it properly? :-)

In this guide we’ll be using the sbctl utility, which is part of the default Tumbleweed repositories.

# zypper in sbctl

1. Put the UEFI Firmware into “Custom mode” in Secure boot and erase all keys

This should disable secure boot and put the system into setup mode. Reboot the system

# sbctl status
...
Setup Mode:      Enabled
Secure boot:     Disabled
...

2. Create keys

We need to create our own Platform Key. This is the master key that allows modifications of the other key types. The Platform Key itself cannot sign a boot binary.

# sbctl create-keys

This will create the key hierarchy/structure in /var/lib/sbctl/keys

Ensure you have backups of those keys!!!

3. Add SUSE keys

We need two SUSE Keys from https://www.suse.com/support/security/keys/

• The SUSE Secure Boot Signing Certificate Authority certificate (SB CA) to be enrolled in the KEK (to allow enrollment of future keys)
• The actual SUSE Secure Boot Signing Key to be enrolled in the db

This is achieved by putting the keys (in der format) into the /var/lib/sbctl/keys/custom/{db,kek} directories (need to be created)

mkdir -p /var/lib/sbctl/keys/custom/{db,kek}
chmod 0700 /var/lib/sbctl/keys/custom/{db,kek}

To convert a crt file to der use e.g. openssl:

openssl x509 -in FILE.crt -outform DER -out OUT.der

In this guide we’ll be using the SUSE SB CA from the above website, save it locally, and convert it to SUSE-SB-CA.der. This file needs to be placed to /var/lib/sbctl/keys/custom/kek.

For the boot key we’re gonna use the one provided by the shim package:

$ rpm -ql shim
/etc/uefi/certs/4659838C-shim-opensuse.crt

Convert this file to der (see command above) and place it in /var/lib/sbctl/keys/custom/db.

4. Enroll keys

To only enroll your own keys use the following command:

# sbctl enroll-keys --custom

Warning: this does not include the Microsoft keys, which might be needed to load some additional drivers (e.g. 3rd party graphics card drivers). Use --microsoft to also include them, but that also means that everything signed with that key will be able to boot:

# sbctl enroll-keys --microsoft --custom

Now reboot and check if secure boot is enabled with your own keys:

# sbctl status
Installed:       sbctl is installed
Owner GUID:      ...
Setup Mode:      Disabled
Secure Boot:     Enabled
Vendor Keys:     custom

Test if your setup is only accepting the openSUSE keys e.g. by trying to boot a Fedora iso (that should not be possible anymore).

Congratulations, you have configured your computer to only boot binaries that are signed with the openSUSE key!