CTE Agent Installation with UEFI Secure Boot

If you want to install the CTE Agent software on a Linux system that has UEFI Secure Boot enabled, you must first download the appropriate Thales public certificate for your version of CipherTrust Transparent Encryption, and add that certificate to the MOK (Machine Owner Key) list.

Note

• The Thales public certificate is valid for three years from the date of issuance. Six months before the current public certificate is set to expire, Thales will release an advisory, along with the new certificate, that will become valid after the six month grace period expires. All future builds of CipherTrust Transparent Encryption will be built with the new certificate.

Warning

• You can only use the new certificate if the CTE build has been signed with the new certificate. If you are using an older version of CipherTrust Transparent Encryption that was signed with a previous certificate, then you must use that certificate with CipherTrust Transparent Encryption.

Public Certificate Naming Convention

The Thales public certificate name is CTE_Secure_Boot_Cert_MM-DD-YYYY.der:

Example

CTE_Secure_Boot_Cert_05-15-2023.der

Getting the Current Public Certificate

There are two options for getting the certificate:

Option 1: Install the DER file

1. Download the CipherTrust Transparent Encryption binaries to your local system.

2. Use the -e option to extract the public certificate from the downloaded binary:

   ./<cte-binary-name>.bin -e

   Copy

   Example

   ./vee-fs-7.7.0-87-95-rh8-x86_64.bin -e

   Copy

3. Add the certificate to the MOK list.

Option 2: Convert the PEM file to DER

1. Download the certificate from the Thales public directory CTE_Secure_Boot Repository

   curl -O https://packages.vormetric.com/pub/CTE_Secure_Boot/<certificate_name>.pem

   Copy

   Example

   curl -O https://packages.vormetric.com/pub/CTE_Secure_Boot/CTE_Secure_Boot_Cert_05-15-2023.pem

   Copy
   

   Note

   You can also download it from the Thales Customer Support Portal: KB0027431.

2. Convert the certificate from a PEM file to a DER file using the following command:

   openssl x509 -inform PEM -outform DER -in <certificate_name>.pem -out <certificate_name>.der

   Copy

   Example

   openssl x509 -inform PEM -outform DER -in CTE_Secure_Boot_Cert_05-15-2023.pem -out CTE_Secure_Boot_Cert_05-15-2023.der

   Copy

3. Add the certificate to the MOK list.

Adding the Certificate to the MOK List

Note

During this procedure, you must reboot the Linux host and then respond to a system prompt as soon as the host restarts.

1. Log into the host as root.

2. Add the certificate to the MOK list:

   mokutil --import <cert-name>

   Copy

   Example

   mokutil --import CTE_Secure_Boot_Cert_05-15-2023.der

   Copy

3. Enter and confirm a password for this request when prompted.

4. Reboot the host and follow the instructions on the console when the host is back online. You will need to enter the password you created in the previous step when prompted. For detailed information, refer to the specific instructions from each linux distribution.

   

   Note

   If you do not respond to the system prompt to update the MOK when the host restarts, the prompt will time out and you will need to run the mokutil command again.

5. When prompted, reboot the host again.

6. After the host has rebooted for the second time, verify that the certificate has been properly added to the MOK list:

   mokutil --test-key <cert-name>

   Copy

   Example

   mokutil --test-key CTE_Secure_Boot_Cert_05-15-2023.der

   Copy

   Response

   CTE_Secure_Boot_Cert_05-15-2023.der is already enrolled.

   Copy