|
Post by AMI_Mani on Feb 10, 2021 17:43:02 GMT
Hi, We have UefiSignatureOwner for secure boot database certificates
UefiSignatureOwner": {
"description": "The UEFI signature owner for this certificate.",
"longDescription": "The value of this property shall contain the GUID of the UEFI signature owner for this certificate as defined by the UEFI Specification. This property shall only be present for secure boot database certificates.",
"pattern": "([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})",
"readonly": true,
"type": [
"string",
"null"
],
"versionAdded": "v1_2_0"
},
We have boot certificates in Computer system instance(/redfish/v1/Systems/{ComputerSystemId}/Boot/Certificates) and there is no attribute similar to UefiSignatureOwner Can we add new attribute like OwnerGuid for boot certificates in upcoming schema?
Thanks, Mani
|
|
|
Post by mraineri on Feb 11, 2021 17:35:19 GMT
At least from a modeling perspective, we tried to limit properties to data elements you'd find in a certificate. UEFI tracks GUIDs as part of their data structures and has that well-defined in the UEFI Specification. However, outside of the UEFI context, there doesn't seem to be any identifiable data structure that contains a GUID for a certificate (at least as far as the X.509 structures are concerned from RFC5280).
Do you have a specific use case for a general owner GUID for a certificate? Is there any standard that can be referenced for showing how this GUID is used?
|
|
|
Post by AMI_Mani on Feb 12, 2021 2:44:28 GMT
Hi Mike,
Intel EDKII uses the OwnerGuid to store TLS certificates and it's coming as part of BIOS set up.
Please let me know if any further details required
Thanks,
Mani
|
|
|
Post by mraineri on Feb 16, 2021 18:59:39 GMT
It sounds like this is still in the UEFI context, so we probably just want to limit the scope to certificates tracked by UEFI. As far as I'm aware, this is just HTTPS boot and secure boot (at least that's where we have hooks today in the Redfish model). I think we could genericize the description to be anything stored by UEFI, but I'd be hesitant to making this generally available for all certificates.
|
|
|
Post by AMI_Mani on Feb 17, 2021 4:15:18 GMT
You are absolutely right and it's not required for all certificate. Required only for HTTPS boot and secure boot, so it can be supported for this alone
Thanks, Mani
|
|
|
Post by mraineri on Feb 17, 2021 13:39:58 GMT
Sounds good; I'll raise this to the forum for further discussion.
|
|
|
Post by AMI_Mani on Oct 17, 2022 8:44:23 GMT
Hi, Do we have any update on this and still latest schema(http://redfish.dmtf.org/schemas/v1/Certificate.v1_6_0.json) showing same content only
Thanks, Mani
|
|
|
Post by mraineri on Oct 18, 2022 16:29:46 GMT
That's right; this is still specific to UEFI-tracked certificates, and we haven't had any need to expand it further.
|
|