# \[SOLVED\] Secure Boot and custom keys on the AMD motherboard **URL:** \ **Category:** Framework Laptop 13\ **Created:** [October 20, 2023, 8:33am UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362 "2023-10-20T08:33:25Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![resample](https://avatars.discourse-cdn.com/v4/letter/r/22d042/32.png) [@resample](https://community.frame.work/u/resample)\ **Post date:** [October 20, 2023, 8:33am UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/1 "2023-10-20T08:33:25Z")
Can someone confirm whether replacing the platform keys with your own is supported on the AMD motherboard? And if the answer to that is yes, is it safe to clear the factory Secure Boot certificate keyset, and then re-enable Secure Boot without installing the Microsoft Corporation UEFI CA 2011 certificate and bricking the motherboard? According to [FAQ · Foxboron/sbctl Wiki · GitHub](https://github.com/Foxboron/sbctl/wiki/FAQ#option-rom), only computers without an iGPU are generally affected; though, I’d like to be on the safer side, which is why I’m asking. ---
**Author:** ![qemu-system-x86\_64](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/qemu-system-x86_64/32/19267_2.png) [@qemu-system-x86\_64](https://community.frame.work/u/qemu-system-x86_64)\ **Post date:** [October 20, 2023, 2:07pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/2 "2023-10-20T14:07:58Z")
I haven’t tried so there’s no answer, but I think these are helpful to you. [https://wiki.archlinux.org/title/Unified\_Extensible\_Firmware\_Interface/Secure\_Boot](https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot) [https://wiki.gentoo.org/wiki/Secure\_Boot](https://wiki.gentoo.org/wiki/Secure_Boot) ---
**Author:** ![Chris2](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/chris2/32/983_2.png) [@Chris2](https://community.frame.work/u/Chris2)\ **Post date:** [October 20, 2023, 3:06pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/3 "2023-10-20T15:06:29Z")
> [@resample](#): > > Can someone confirm whether replacing the platform keys with your own is supported on the AMD motherboard? Hopefully these help 🙂 ![IMG_1694](https://us1.discourse-cdn.com/flex001/uploads/framework3/original/3X/4/0/40c8e0d6bca0449be8e1a4fd40a072c2ceef39ab.jpeg) ![IMG_1695](https://us1.discourse-cdn.com/flex001/uploads/framework3/original/3X/4/8/48b38c0421ebcef73cfb1465fbf58251b2ae4b0b.jpeg) ---
**Author:** ![resample](https://avatars.discourse-cdn.com/v4/letter/r/22d042/32.png) [@resample](https://community.frame.work/u/resample)\ **Post date:** [October 20, 2023, 4:40pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/4 "2023-10-20T16:40:21Z")
> [@Chris2](#): > > Hopefully these help 🙂 Cheers! Now, is someone brave enough to attempt to erase the factory keys to verify whether the motherboard POSTs and is fully-functional without them? 😁 ---
**Author:** ![kjhoerr](https://avatars.discourse-cdn.com/v4/letter/k/8797f3/32.png) [@kjhoerr](https://community.frame.work/u/kjhoerr)\ **Post date:** [October 20, 2023, 9:52pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/5 "2023-10-20T21:52:46Z")
I did this a little bit ago successfully, and yes - selecting “Erase all Secure Boot Settings” puts it in Setup mode so you can enroll your keys. I hadn’t played around with it a ton before (these were the same options provided for 11th gen Intel), but I don’t think there’s any risk of bricking your device unless you absolutely cannot boot with secure boot disabled. You can always go back into the bios to reset things, and I’m pretty sure the restore option reinstates the factory keys. ---
**Author:** ![resample](https://avatars.discourse-cdn.com/v4/letter/r/22d042/32.png) [@resample](https://community.frame.work/u/resample)\ **Post date:** [October 21, 2023, 7:47am UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/6 "2023-10-21T07:47:55Z")
> [@kjhoerr](#): > > I don’t think there’s any risk of bricking your device unless you absolutely cannot boot with secure boot disabled. You can always go back into the bios to reset things, and I’m pretty sure the restore option reinstates the factory keys. Unfortunately, according to the page on Secure Boot in ArchWiki, there is still a risk of soft-bricking the device if the Option ROM of one of its components is signed against Microsoft’s keys. Furthermore, if I understand the process of setting Secure Boot up correctly, you can only find out if it soft-bricks for you after enrolling exclusively your keys and then enabling Secure Boot. So, unless resetting UEFI settings by cutting power supply to the motherboard restores its factory keyset, in the worst case scenario, you won’t be able to make it POST again, mandating a replacement. ---
**Author:** ![kjhoerr](https://avatars.discourse-cdn.com/v4/letter/k/8797f3/32.png) [@kjhoerr](https://community.frame.work/u/kjhoerr)\ **Post date:** [October 21, 2023, 5:56pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/7 "2023-10-21T17:56:30Z")
> [@resample](#): > > according to the page on Secure Boot in ArchWiki, there is still a risk of soft-bricking the device if the Option ROM of one of its components is signed against Microsoft’s keys. Furthermore, if I understand the process of setting Secure Boot up correctly, you can only find out if it soft-bricks for you after enrolling exclusively your keys and then enabling Secure Boot. Oh, that’s something I forgot to mention in my post. I did not include the Microsoft keys via sbctl when I enrolled my keys. Unless the OpROMs are signed differently for the same hardware platform for some reason, anecdotally it works fine for me. ---
**Author:** ![resample](https://avatars.discourse-cdn.com/v4/letter/r/22d042/32.png) [@resample](https://community.frame.work/u/resample)\ **Post date:** [October 21, 2023, 8:43pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/8 "2023-10-21T20:43:28Z")
@kjhoerr To be sure, did I understand correctly that you enrolled your keys (without Microsoft’s ones) to the UEFI, on an AMD-based Framework laptop? ---
**Author:** ![kjhoerr](https://avatars.discourse-cdn.com/v4/letter/k/8797f3/32.png) [@kjhoerr](https://community.frame.work/u/kjhoerr)\ **Post date:** [October 23, 2023, 2:11pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/9 "2023-10-23T14:11:42Z")
> [@resample](#): > > To be sure, did I understand correctly that you enrolled your keys (without Microsoft’s ones) to the UEFI, on an AMD-based Framework laptop? Yes. To be sure, I reran the process for enrolling my sb keys since that’s easy enough to do: ![image](https://us1.discourse-cdn.com/flex001/uploads/framework3/original/3X/4/8/489691bc1cab83ccd7cd7a208bb73c484d7abb5e.jpeg) ![image](https://us1.discourse-cdn.com/flex001/uploads/framework3/original/3X/5/3/530e2014d9b584ecfd56b07afc685dab569245f5.jpeg) ---
**Author:** ![resample](https://avatars.discourse-cdn.com/v4/letter/r/22d042/32.png) [@resample](https://community.frame.work/u/resample)\ **Post date:** [November 9, 2023, 7:42pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/10 "2023-11-09T19:42:07Z")
@kjhoerr I’m going to attempt to enroll my own keys any day now but before I do, I need to be 100% sure I won’t soft-brick my motherboard, because I need the computer to remain in a working state in the coming weeks. So, I want to ask you, have you encountered any problems that might’ve been connected to Secure Boot after updating to the now-latest stable firmware (3.0.3)? And if you haven’t, may you please confirm that the only keys that are listed under the DB, KEK, and PK options in the Secure Boot section of the firmware settings are the ones that belong to you? I know I’m beginning to display symptoms of a broken record but all I need is some more reassurance 😅 ---
**Author:** ![kjhoerr](https://avatars.discourse-cdn.com/v4/letter/k/8797f3/32.png) [@kjhoerr](https://community.frame.work/u/kjhoerr)\ **Post date:** [November 10, 2023, 12:40am UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/11 "2023-11-10T00:40:22Z")
> [@resample](#): > > So, I want to ask you, have you encountered any problems that might’ve been connected to Secure Boot after updating to the now-latest stable firmware (3.0.3)? And if you haven’t, may you please confirm that the only keys that are listed under the DB, KEK, and PK options in the Secure Boot section of the firmware settings are the ones that belong to you? Nope, been running on 3.03 since that was released without any issues. Right, I’m not sure how it looks by default, but there’s only one entry each for PK, KEK, and DB, and the owner GUID for each of those is the same as is stated in `sbctl status`. The DBR, DBT, DBX have no entries. ---
**Author:** ![kirelagin](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/kirelagin/32/16165_2.png) [@kirelagin](https://community.frame.work/u/kirelagin)\ **Post date:** [November 19, 2023, 9:37pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/12 "2023-11-19T21:37:37Z")
Just wanted to also confirm that I enrolled my own keys and no vendor keys, and everything works fine! ```plaintext # sbctl status Installed: ✓ sbctl is installed Owner GUID: 40b8c598-846b-421e-95d0-78ec53efa8e8 Setup Mode: ✓ Disabled Secure Boot: ✓ Enabled Vendor Keys: none ``` There are no OpRoms whose signatures would be checked during boot on Frameowrk 13 AMD. ```plaintext # tpm2 eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep BOOT_SERVICES_DRIVER || echo 'Nothing!' Nothing! ``` ---
**Author:** ![olaflostviking](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/olaflostviking/32/20192_2.png) [@olaflostviking](https://community.frame.work/u/olaflostviking)\ **Post date:** [December 4, 2023, 3:09pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/13 "2023-12-04T15:09:42Z")
Hi, @resample (and everybody else who was so helpful here)! How did your adventure go? 🙂 I’m at the same point as you were. Willing to finally secure the machine (which means having only self-created keys for my Linux), but somewhat “scared” as there is also vendor data (Framework’s builtin-db, builtin-KEK, builtin-PK) in addition to the key(s) by Microsoft and I read the same warnings as you - that iGPU blobs may be necessary to be signed for the UEFI to even show. And there are so many DBX entries, I don’t want to get rid of something that’s needed. I would now go to the UEFI, select “Erase all Secure Boot Settings”, reboot without Secure Boot activated, sign my boot loader, kernel, and initramfs, enroll the keys with “sbctl” and reactivate Secure Boot (hoping for the best 😉 ). Is there anything else I need to take care of? And is there a way to later re-add the Framework and Microsoft-Keys? In case I’ll update the mainboard one day and somebody wants to install some proprietary OS! There’s the “Restore Secure Boot to Factory Settings” option in the UEFI that @kirelagin already mentioned (but didn’t try out). Did anybody verify that this will restore “backups” of the keys? @kirelagin You showed how you verified that no firmware (drivers for the UEFI) is checked. Could that be something that will later be introduced by some update and then lead to breakage? Thanks a bunch! ---
**Author:** ![DHowett](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/dhowett/32/1990_2.png) [@DHowett](https://community.frame.work/u/DHowett)\ **Post date:** [December 4, 2023, 3:48pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/14 "2023-12-04T15:48:46Z")
> [@olaflostviking](#): > > And is there a way to later re-add the Framework and Microsoft-Keys? `sbctl` has an option to include any vendor-provided certificates as well as the Microsoft ones! It uses the versions that are provided by the firmware, in the `dbDefault` (and `KEKdefault`) variables. ---
**Author:** ![kirelagin](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/kirelagin/32/16165_2.png) [@kirelagin](https://community.frame.work/u/kirelagin)\ **Post date:** [December 4, 2023, 3:48pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/15 "2023-12-04T15:48:53Z")
> [@olaflostviking](#): > > And there are so many DBX entries, I don’t want to get rid of something that’s needed. You won’t need the signature dbs for the Microsoft key if you are not enrolling the Microsoft key. I have to admit that I’m not sure how to add Microsoft dbx separately, although I’m pretty sure it shows as part of Framework firmware in fwupd, so it should be possible to get them from there somehow. > [@olaflostviking](#): > > And is there a way to later re-add the Framework and Microsoft-Keys? Haven’t tried myself, but I think people here on the forum reported that resetting secure boot settings to defaults restores the Microsoft stuff. > [@olaflostviking](#): > > Could that be something that will later be introduced by some update and then lead to breakage? That depends on the hardware, so I don’t think it would be possible. ---
**Author:** ![DHowett](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/dhowett/32/1990_2.png) [@DHowett](https://community.frame.work/u/DHowett)\ **Post date:** [December 4, 2023, 3:51pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/16 "2023-12-04T15:51:15Z")
> [@olaflostviking](#): > > And there are so many DBX entries, I don’t want to get rid of something that’s needed. You should include the entire DBX, rather than redacting any part of it. If you do ever reinstall the Microsoft keys it will suddenly become meaningful again. It’s a list of binary and certificate hashes to never allow on your machine. Unless you have a very good reason to be running one of those binaries (which is going to be either malware or a vulnerable bootloader,) you’ll want to block them all. ---
**Author:** ![olaflostviking](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/olaflostviking/32/20192_2.png) [@olaflostviking](https://community.frame.work/u/olaflostviking)\ **Post date:** [December 6, 2023, 11:44pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/17 "2023-12-06T23:44:14Z")
Thanks for your replies! Just as a FYI for future readers: I took a leap of faith and deleted all signatures/keys (okay, just one in DBX… But PK, KEK and DB were empty.) which made “Secure Boot” unavailable on the next reboot in the UEFI. Using “Restore Secure Boot to Factory Settings” worked as expected all all Signatures/keys were restored as they were before. Now, I can start playing around with Secure Boot eventually 🙂 ---
**Author:** ![Almindor](https://avatars.discourse-cdn.com/v4/letter/a/96bed5/32.png) [@Almindor](https://community.frame.work/u/Almindor)\ **Post date:** [February 10, 2024, 11:02pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/18 "2024-02-10T23:02:19Z")
I can confirm that secure boot enrollment was a breeze and seems to work without microsoft keys. I didn’t do anything like firmware update since then but everything normal works fine. This on Arch linux using sbctl. The only thing that I had to deal with was that I made a type when setting up my partition type for the /boot partition and had to fix the type in gdisk but it was an issue of my making. ![screenshot_2024-02-10_15-00-00_656822877](https://us1.discourse-cdn.com/flex001/uploads/framework3/original/3X/e/5/e5f95d8d1366db9ff084d6c6395e678969681967.png) ---
**Author:** ![shawnyeager](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/shawnyeager/32/52075_2.png) [@shawnyeager](https://community.frame.work/u/shawnyeager)\ **Post date:** [November 3, 2024, 3:39pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/19 "2024-11-03T15:39:16Z")
I’m still stumped on this. I keep getting dropped into grub rescue. On that note, is anyone who’s successfully achieved secure boot with Arch also using luks encryption, btrfs, snapper, and grub? I’m trying to narrow down what may be throwing me. Thanks. ---
**Author:** ![Almindor](https://avatars.discourse-cdn.com/v4/letter/a/96bed5/32.png) [@Almindor](https://community.frame.work/u/Almindor)\ **Post date:** [January 3, 2025, 6:44pm UTC](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362/20 "2025-01-03T18:44:07Z")
Sorry, I didn’t use any bootloader with this, only efistub directly. I don’t know what your situation is, but have you considering doing that? It seems daunting at first but it’s actually quite liberating not having a middle-bootloader. I just use this script to add an entry: ```auto efibootmgr --create --disk /dev/nvme0n1p1 --part 1 --label 'Arch Linux' --loader /vmlinuz-linux --unicode 'cryptdevice=UUID=5abaf7c7-3346-4fb2-8454-6f083b061590:root:allow-discards root=/dev/mapper/root rw initrd=\amd-ucode.img initrd=\initramfs-linux.img resume=UUID=cd11b5ac-15df-40e8-99d6-07d0cbe4fb72 resume_offset=6038784 mitigations=off' ``` NOTE: I did setup hooks [as per this wiki entry](https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Automatic_signing_with_the_pacman_hook) and provide the signed `fwupdx64.efi` file for this. This does make it a bit less safe of course, since anyone gaining root access on my machine could change any of this then and piggyback a bootkit in, but I don’t think I’m THAT interesting. If you want to be really sure, you could put the keys into an usb disk and manually sign each time. [Next page](https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362.md?page=2)