Sign MOK using external CA?

[My1]

is that possible?

at least normal secure boot stuff usually comes from a CA that signs the keys and I wonder if you can do the same with a MOK, so that instead of enrolling the MOK directly, you sign it using a CA you have outside, possibly even on a smartcard if you are really insane.

so that you create it on your system in a SUPER strict manner like TPM which a whole bunch of PCRs, and if that breaks instead of needing to enroll a new MOK which can be quite annoying especially if you are remote, you just make a new MOK, sign it using your external CA, and boom, you are good to go.

[Foxboron]

sbctl does not deal with MOK, that is what shim and mokutil is for. Are you thinking about signing updates for db with an external KEK?

[My1]

they are different? I thought MOK is just a general term for using your own keys for secure Boot.

[Foxboron]

Please read the tianocore documentation about UEFI keys.

https://tianocore-docs.github.io/Understanding_UEFI_Secure_Boot_Chain/draft/additional_secure_boot_chain_implementations/machine_owner_key_mok.html

[My1]

I see and sbctl just skips the whole shim thing entirely I guess. the shim method seems kinda needlessly complicated lol, in both cases it's about the machine owner supplying their own keys for signing stuff for secure boot tho :-)