Windows 10: Windows UEFI Secure Boot .efi File Signed by Customized Key

Hi,





My company is recently exploring an feature related Secure Boot, we want our hardware to enable secure boot on Windows, then lock down the firmware. Thus, no one can erase our Windows OS and install other OS. After several attempts, I noticed that Windows will not allow me to sign its .efi files with my own DB key, it will fail to boot. eg. the bootx64.efi signed by my DB.key cannot be verified by Microsoft's certificates installed on Windows.





I was wondering if Microsoft offers any service to customize Windows OS image creation with my org's certificates installed, then I can use our own key to sign .efi and the signed .efi file still gets recognized by the Windows OS.





Or if there is any alternative way to archive our goal above, please advise.





Thank you.

:)

 

Windows 8 Secure Boot Feature: Not So Secure?

So Linux is switching to secure boot also? Or they have to because of UEFI?

 

Windows 8 Secure Boot Feature: Not So Secure?

• Linux
• Linux
• Linux
• Linux
• Oh and OSX

Here is a statement from a Kernal Developer at Red Hat:

I'm not sure this exploits the legacy BIOS but rather it exploits the legacy boot method on MBR drives, injecting a signed key before the OS boots, which you are correct in that it has nothing to do with Windows 8. And the simplest fix would just be to require boot drives use GPT when Secure Boot is enabled in UEFI.

 

Can't disable UEFI boot on HP 250 G3

I got it, I was not accustomed to UEFI (because on HP 4540s I disabled it) and I automatically thought that if I boot from the first menu it will boot in UEFI mode, but I have to go to second menu "Boot From EFI File" to get a list of EFI boot options:



I installed Ubuntu Mate and Windows 8.1 from the first menu (the picture) and they both installed in BIOS mode. Quite simple really.