2

I am following steps given here to generate keys in order to sign a copy of kernel I compiled myself. However, midway through the process, when I try to verify that "the master certificate is signed with its private key" by running

$ openssl verify ./master-public.pem

it fails with the following output:

C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
error 18 at 0 depth lookup: self signed certificate
error ./master-public.pem: verification failed

The expected output according to documentation is:

./master-public.pem: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
error 18 at 0 depth lookup:self signed certificate
OK

As is probably obvious, I am not an expert in Secure Boot related shenanigans, and have spent quite a while trying to figure out what's wrong without any leads. The webpage mentioned above doesn't give provide any help either.

Can some one tell me why this error might be happening, and how to fix it? Are the instructions on Ubunutu's Wiki obsolete? If yes, are there any up-to-date instructions available? All I want to do is compile and run a copy of staging kernel with Secure Boot on.

strNOcat
  • 445

2 Answers2

2

I ended up with

  • building my own kernel with make bindep-pkg from vanilla TGZ from https://kernel.org
  • booting it with kexec

So no signing is needed: UEFI boots officially signed Ubuntu kernel, then my custom kernel is loaded from Linux userspace as cron @reboot task.

Pavel Piatruk
  • 31
1

The steps given here actually worked.

rootmeanclaire
  • 135
strNOcat
  • 445