# Enable UEFI secure boot
Source: [https://docs.qualcomm.com/doc/80-70015-11/topic/enable-uefi-secure-boot.html](https://docs.qualcomm.com/doc/80-70015-11/topic/enable-uefi-secure-boot.html)
You can setup an initial UEFI secure boot configuration, and convert keys and
certificates into a format that UEFI can understand.
See the workflow to understand the off-target preparation and the on-device
execution.
## Prerequisites to generate UEFI secure boot key
Ensure that the following tools are installed:
| Tool | Description |
| --- | --- |
| OpenSSL *0.9.80 June 2010* (or later version) | This tool must be installed on the Linux host machine. |
| Cert-to-efi-sig-list | This tool converts OpenSSL certificates to EFI signature lists.
It is installed as part of the efitools
package. |
| Sign-efi-sig-list | This tool signs the EFI signature list, which is essential for
managing secure variables in UEFI. It is installed as part of the
efitools package. |
| Hash-efi-sig-list | This tool creates a hash signature list entry from a
binary. |
- **[Generate key and certificate](https://docs.qualcomm.com/doc/80-70015-11/topic/generate-key-and-certificate.html)**
To enable UEFI secure boot, generate a pair of keys and certificates for signing and authentication.
- **[Sign images and copy (.auth) key/signed files to EFI partition](https://docs.qualcomm.com/doc/80-70015-11/topic/sign-images-and-copy-auth-key-signed-files-to-efi-partition.html)**
The EFI system partition consists of EFI, loader, and dtb directories with information relevant to the EFI when using the systemd-boot.
- **[Enable UEFI secure boot from systemd-boot menu](https://docs.qualcomm.com/doc/80-70015-11/topic/enable-uefi-secure-boot-from-systemd-boot-menu.html)**
The EFI binary is composed of signed images and secure boot keys, which are generated and then flashed into the system. For more details, see [Sign images and copy (.auth) key/signed files to EFI partition](https://docs.qualcomm.com/doc/80-70015-11/topic/sign-images-and-copy-auth-key-signed-files-to-efi-partition.html).
- **[Hash unsigned images and update DB for image authentication](https://docs.qualcomm.com/doc/80-70015-11/topic/hash-unsigned-images-and-update-db-for-image-authentication.html)**
UEFI secure boot allows image authentication. This authentication is achieved through the hash of images stored in the signature database (DB), even if the images are not signed or the certificates in the images are not present in the DB.
**Parent Topic:** [Configure](https://docs.qualcomm.com/doc/80-70015-11/topic/configure.html)
Last Published: Oct 14, 2024
[Previous Topic
Enable SELinux](https://docs.qualcomm.com/bundle/publicresource/80-70015-11/topics/enable-selinux.md) [Next Topic
Generate key and certificate](https://docs.qualcomm.com/bundle/publicresource/80-70015-11/topics/generate-key-and-certificate.md)