UEFI Secureboot with iPXE (selfsigned db,pk keys or shim + company cert signed by M$)

[NiKiZe]

One issue with shim + ipxe is how would it be possible for it to PXE chainload the shim and then ipxe when there is no driver etc in the shim? or can grub boot over the network via shim as well?

Currently all loading of anything from within ipxe is done via normal firmware load, so all the verifying is done by efi firmware.

An alternative might be to use a signed shim.efi that can just take extra options for what it loads and with options, so your ipxe script would end up as

Code:

#!ipxe
initrd http://192.168.1.100/rhel72/images/pxeboot/initrd.img
initrd http://192.168.1.100/rhel72/images/pxeboot/vmlinuz
chain http://192.168.1.100/rhel72/images/pxeboot/shim.efi vmlinuz initrd=initrd.img inst.repo=http://192.168.1.100/centos7/

This is similar to what wimboot currently does.

This is just ideas based on what I have read about the ipxe signing.
We will need mcb30's input here.