In order to create keys for signing kernels, first generate new keys using the utility and then follow the relevent sections of [Sakaki's EFI Install Guide](https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki's_EFI_Install_Guide/Configuring_Secure_Boot) for appending the keys to your existing keys (I won't go into detail here as the method varies across motherboards - it may be using the efi-updatevar command, it may be by accessing the keystore directly from the BIOS GUI and appending keys from a USB stick, etc). Once exported using efi-readvar, this should create a valid set of key files/certificates.
0 commit comments