UEFI Secure Boot:
UEFI can store whitelisted digital certificates in a signature database (DB). There is also a blacklist of forbidden certificates (DBX), a Key Exchange Keys (KEK) database and a platform key. These digital certificates are used by the UEFI firmware to validate the boot loader.
Boot loaders are
typically cryptographically signed and their digital signature chains to
the certificate in the firmware.The default digital certificate in
almost every implementation of UEFI firmware is a x509 Microsoft UEFI
Public CA cert.
Most of the UEFI implementations also allows the installation of additional certificate in the UEFI firmware and UEFI would validate boot loader against that certificate.
UEFI Secure Boot in ESXi 6.5:
ESXi is comprised of
components like boot loader, the VM Kernel, Secure Boot Verifier and
VIBs. Each of these components is cryptographically signed.
The Secure Boot Verifier validates every cryptographically signed VIB against the VMware public key. A VIB (TAR g-zipped file) comprises, an XML descriptor file and a digital signature file. When ESXi boots, it creates a file system in memory that maps to the contents of the VIBs. If the file never leaves the cryptographically signed “package” then you don’t have to sign every file, just the package.
/usr/lib/vmware/secureboot/bin/secureBoot.py -c
The output either includes "Secure Boot can be enabled" or "Secure boot cannot be enabled".
Most of the UEFI implementations also allows the installation of additional certificate in the UEFI firmware and UEFI would validate boot loader against that certificate.
UEFI Secure Boot in ESXi 6.5:
With the release of
vSphere 6.5, ESXi 6.5 has adopted support for UEFI Secure boot. UEFI
Secure boot ensures that ESXi server boots with signed boot loader that
is validated by UEFI Firmware and also ensures that unsigned code does
not run on hypervisor.
 |
| Image: VMware |
The boot process of ESXi 6.5 with UEFI Secure Boot:
- Host is Powered On.
- UEFI Firmware validates the ESXi Boot Loader against the Microsoft digital certificate in the UEFI firmware.
- ESXi Boot Loader validates the kernel against the VMware digital certificate in the Boot Loader.
- Kernel runs the Secure Boot Verifier.
- Secure Boot Verifier validates each VIB against the VMware digital certificate in the Secure Boot Verifier.
- Management applications (DCUI, hostd, etc) now run on the ESXi host.
The ESXi boot loader is
signed with the Microsoft UEFI Public CA cert. This ensures that
standard UEFI Secure Boot firmware can validate the VMware boot loader.
The boot loader code
contains a VMware public key. This VMware key is used to validate the VM
Kernel and a small subset of the system that includes the Secure Boot
Verifier, used to validate the VIBs.
The VMKernel itself is cryptographically signed using the VMware public key. The boot loader validates the kernel using the VMware public key it has. The first thing the VMKernel runs is the Secure Boot Verifier.
The VMKernel itself is cryptographically signed using the VMware public key. The boot loader validates the kernel using the VMware public key it has. The first thing the VMKernel runs is the Secure Boot Verifier.
The Secure Boot Verifier validates every cryptographically signed VIB against the VMware public key. A VIB (TAR g-zipped file) comprises, an XML descriptor file and a digital signature file. When ESXi boots, it creates a file system in memory that maps to the contents of the VIBs. If the file never leaves the cryptographically signed “package” then you don’t have to sign every file, just the package.
Prerequisites to enable UEFI Secure Boot:
- Verify that the hardware supports UEFI secure boot by default or if any firmware upgrade is required.
- Verify that all VIBs are signed with an acceptance level of at least PartnerSupported. If you include VIBs at CommunitySupported level, you cannot use secure boot.
Enabling UEFI Secure boot post upgrade to ESXi 6.5:
We can call a validation script located on ESXi host to ensure that we can enable Secure Boot after upgrade to 6.5:
No comments:
Post a Comment