Secure Boot
HPE Superdome Flex Server systems support features that secure the boot process. When enabled, Secure Boot prevents
execution of OS loaders, drivers, and UEFI applications that are not signed with an acceptable digital signature.
NOTE: Secure Boot is only supported on systems with firmware versions 2.5.246 or later and HFS versions1.3 or later on
Linux systems.
Secure Boot requires signed I/O firmware drivers. Currently all 10/25Gb I/O adapters supported on Superdome Flex
Server also support Secure Boot operation. See the Superdome Flex Server
www.hpe.com/support/superdome-flex-
quickspecs for a list of supported i/O adapters.
Secure boot features
When secure boot is enabled on Superdome Flex Server, system firmware verifies OS loader, driver, and UEFI application
signatures before executing them.
By default, secure boot is disabled. This default applies to systems shipped from the factory, and to newly created
Superdome Flex Server partitions.
Many secure boot configuration changes require resetting the partition before booting an OS or accessing the UEFI Shell.
Secure boot protection applies both at the Boot Manager menu and at the UEFI Shell. In secure boot mode, the UEFI Shell
disables the
mm
and
hexedit
commands.
System logs record changes to the secure boot mode. Secure boot checks performed during firmware verification also are
logged.
Default secure boot keys
The default keys include signatures for supported operating systems.
The Superdome Flex Server default secure keys permit execution of images signed by the following certificates:
• HPE KEK 2016
• Microsoft Corporation KEK CA 2011
• SUSE Linux Enterprise Secure Boot CA
• HPE DB 2016
• HP DB 2013
• Microsoft Corporation UEFI CA 2011
• Microsoft Windows Production PCA 2011
• SUSE Linux Enterprise Secure Boot Signkey
• VMware ESX40 certificate
• VMware certificate 2017
Enabling Secure Boot with CLI
Secure Boot can be enabled and disabled with RMC CLI commands.
Secure Boot
49
