On 10/26/23 14:37, jacopo.r0...@gmail.com wrote: > Hi there, > > I was trying to HTTPs boot a virtual machine with the following scenario: > > 1) I have a self signed root CA /root.crt /and then I use it to sign > another self signed certificate /myip.crt /for the IP address X.X.X.X > 2) I have an NGINX server configured to use SSL with the /myip.crt > /certificate and its key. > 3) I have a UEFI virtual machine configured to HTTPs boot and trust the > CA certificate /root.crt /.
How exactly did you configure your VM (runnig presumably ArmVirtQemu or OVMF) to accept the root certificate? See the SetCaCerts() function in "OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.c". See also the "HTTPS Boot" section in "OvmfPkg/README" If you build OVMF with DEBUG_VERBOSE enabled (pass "--pcd=gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel=0x8040004F" to "build"), and attach the firmware log (search "OvmfPkg/README" for "debugcon"), that might help with the analysis. It's quite possible that the certificate chain you've created is not accepted by how edk2 uses OpenSSL, but we need to check more closely to determine that. Can you include a textual dump of your CA cert / server cert, too? Laszlo > > Unfortunately the machine fails in the SSL handshake step and then the > UEFI config page is shown again. Using for example /curl --cacert > root.crt X.X.X.X /it works perfectly fine (also forcing curl to use tls > 1.2). > > In addition to that, if I do not use a root certificate for the server's > IP (i.e. I do not build a chain of certificates), the machine boots fine. > > Unfortunately I don't have a physical server to make a real test. Is > this a missing feature, a bug, or am I doing it completely wrong? > > Thank you very much! > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110127): https://edk2.groups.io/g/devel/message/110127 Mute This Topic: https://groups.io/mt/102201552/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/leave/9847357/21656/1706620634/xyzzy [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
