Re: [edk2-devel] SSL handshake in HTTPS boot if the certificate was signed with a root certificate

["Laszlo Ersek" <lersek@redhat.com>]

On 10/26/23 14:37, jacopo.r00ta@gmail.com wrote:
> Hi there,
> 
> I was trying to HTTPs boot a virtual machine with the following scenario:
> 
> 1) I have a self signed root CA /root.crt /and then I use it to sign
> another self signed certificate /myip.crt /for the IP address X.X.X.X
> 2) I have an NGINX server configured to use SSL with the /myip.crt
> /certificate and its key.
> 3) I have a UEFI virtual machine configured to HTTPs boot and trust the
> CA certificate /root.crt /.

How exactly did you configure your VM (runnig presumably ArmVirtQemu or
OVMF) to accept the root certificate?

See the SetCaCerts() function in
"OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.c".

See also the "HTTPS Boot" section in "OvmfPkg/README"

If you build OVMF with DEBUG_VERBOSE enabled (pass
"--pcd=gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel=0x8040004F" to
"build"), and attach the firmware log (search "OvmfPkg/README" for
"debugcon"), that might help with the analysis.

It's quite possible that the certificate chain you've created is not
accepted by how edk2 uses OpenSSL, but we need to check more closely to
determine that. Can you include a textual dump of your CA cert / server
cert, too?

Laszlo

> 
> Unfortunately the machine fails in the SSL handshake step and then the
> UEFI config page is shown again. Using for example /curl --cacert
> root.crt X.X.X.X /it works perfectly fine (also forcing curl to use tls
> 1.2).
> 
> In addition to that, if I do not use a root certificate for the server's
> IP (i.e. I do not build a chain of certificates), the machine boots fine.
> 
> Unfortunately I don't have a physical server to make a real test. Is
> this a missing feature, a bug, or am I doing it completely wrong?
> 
> Thank you very much!
> 
> 



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#110127): https://edk2.groups.io/g/devel/message/110127
Mute This Topic: https://groups.io/mt/102201552/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/leave/12367111/7686176/1913456212/xyzzy [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-