3 ms·
Is it ? MS requirements are to be able to turn off Secure Boot, not allow changing the CA. I wouldn't be surprised if most manufacturers just implement the form
by zimbatm 14y ago
Is it ? MS requirements are to be able to turn off Secure Boot, not allow changing the CA. I wouldn't be surprised if most manufacturers just implement the former.
- bcl 14y agoAll of the manufacturers that I am aware of allow you to load your own keys.
- deleted 14y ago[deleted]
- tzs 14y agoMS also requires allowing for user replacement of all keys.
- drdaeman 14y agoBut only on x86_64 and not on ARM, right?
- lambda 14y agoThey require that you have the ability to change the keys; remove the Microsoft ones, load your own keys, etc. The problem is that they don't specify any kind of common interface for doing so, or standard for key formats, or anything of the sort. So how it works can vary greatly between manufacturers, or may be buggy, or the like. So several prominent Linux distros have decided to ship bootloaders signed with Microsoft's keys, so that people can just install the distro without having to go through some hardware specific key loading process that may brick their machine.