topic Secure Boot PK Key change with S2600CWTR? in Intel® Xeon® Processor and Server Products

Secure Boot PK Key change with S2600CWTR?

BBen1 — Fri, 29 Jul 2016 08:33:06 GMT

Hallo,

i try to install my own Secure Boot PK Cert but dont can find an way to remove the

pre installed. So Secure Boot runs in User Mode and i cant get in Setup Mode.

Is there a way to remove the PK key oder get Secure Boot into Setup Mode?

What i found is that some Intel Boards have the Bios Menu entry to set Secure Boot Mode to Custome but this dont.

With Keytools i dont can remove the installed PK without an auth file that i dont have.

And can i even prove that this PK is really from Intel?

Used last Updates:

BIOS ID : SE5C610.86B.01.01.0016.033120161139

BMC FW Rev : 1.43.9685

Boot FW Rev : 1.07

SDR Package Version : SDR Package 1.13

Mgmt Engine (ME) FW Rev : 03.01.03.021

Product Name : S2600CWR

Part/Model Number : H12882-260

On Board Installed: TPM AXXTPME5 (but not active)

Bios Options

Keytool

idata — Wed, 03 Aug 2016 19:57:14 GMT

Hello,

Thank you for contacting Intel Customer Support.

We will check on this and try to find a solution for you, as soon as we have our results we will get back to you.

faugub_intel # iwork4intel

BBen1 — Fri, 05 Aug 2016 09:59:56 GMT

Thanks, would be nice to find a solution.

If you need more information or i shoud test something, let me know.

idata — Fri, 05 Aug 2016 16:29:33 GMT

Hello,

After further investigation, we can confirm that it is not possible to remove the pre installed secure boot. Also, the PK comes from Intel.

faugub_intel # iwork4intel

BBen1 — Mon, 08 Aug 2016 08:13:11 GMT

Hallo,

ok thats a major drawback for me, will that get a fix?

Otherwise is this now standard?

Test multiple times Secure Boot with custom PK cert and that works realy nice. (on other Systems)

Sincerely

idata — Mon, 08 Aug 2016 14:33:50 GMT

Hello,

There are not any announcement about it for these products. This might be added on future releases. However, by now it is not supported.

faugub_intel # iwork4intel