Update Certificate for UEFI Capsule update

[Red-Dragon-99]

Hi,

I would like to enable OTA updates on a Secureboot-enabled (i.e. fused) Jetson Orin Nano.
I fused SBK/PKC/etc .. using the following XML:

<genericfuse MagicId="0x45535546" version="1.0.0">
    <fuse name="PublicKeyHash" size="64" value="0x..."/>
    <fuse name="PkcPubkeyHash1" size="64" value="0x..."/>
    <fuse name="PkcPubkeyHash2" size="64" value="0x..."/>
    <fuse name="SecureBootKey" size="32" value="0x..."/>
    <fuse name="Kdk0" size="32"  value="0x..."/>
    <fuse name="OemK1" size="32" value="0x..."/>
    <fuse name="OemK2" size="32" value="0x..."/>
    <fuse name="PscOdmStatic" size="4" value="0x60"/>
    <fuse name="BootSecurityInfo" size="4" value="0x2A09"/>
    <fuse name="SecurityMode" size="4" value="0x1"/>
</genericfuse>

When I boot the device, I see that secureboot is enabled (MB2 prints "RSA PSS signature check: OK") and Linux boots nicely ("EFI stub: UEFI Secure Boot is enabled").
However, when triggering capsule updates they fail with the next reboot and the device stays on the current boot slot.

Surfing through the code, I realized that in tegra-uefi-capsule-signing.class some certificates must be specified:

UEFI_CAPSULE_SIGNER_PRIVATE_CERT ?= "${PYTHON_BASETOOLS}/Pkcs7Sign/TestCert.pem"
UEFI_CAPSULE_OTHER_PUBLIC_CERT ?= "${PYTHON_BASETOOLS}/Pkcs7Sign/TestSub.pub.pem"
UEFI_CAPSULE_TRUSTED_PUBLIC_CERT ?= "${PYTHON_BASETOOLS}/Pkcs7Sign/TestRoot.pub.pem"

I just don't understand how they are derived. Is there any documentation on that? There are no helpful comments in the class file and the NVIDIA documentation just mentions these test files. There is no explanation on how to create your own files. I assume they are somehow related to the keys in the EKB?

Any help is appreciated!

Regards
Stefan

[ichergui]

Hi @Red-Dragon-99
Sorry, I missed your post. Any update about this ?
Were you able to progress/solve the issue ?

[Lexmark-chad]

I think what you are looking for can be found here:

https://github.com/tianocore/edk2/tree/master/BaseTools/Source/Python/Pkcs7Sign