JetPack 6.2.2 / R36.5] Soft Secure Boot — kernel signature rejected by UEFI (both sbsign and l4t_uefi_sign_image.sh)

Robotics & Edge Computing Jetson Systems Jetson AGX Orin
,
1

I’m attempting to enable Soft Secure Boot (Method 2 — reversible,
no fuse burning) on a Jetson AGX Orin Developer Kit, following the
official guide:

After two attempts with different signing tools, the kernel signature
is rejected by the UEFI on first boot after PK enrollment.
Recovery via “Reset Secure Boot Keys” in the UEFI menu works cleanly
both times. I’d appreciate guidance on the correct end-to-end workflow.

════════════════════════════════════════════════════════════════
SYSTEM
════════════════════════════════════════════════════════════════

  • Hardware: Jetson AGX Orin Developer Kit (64 GB)
  • JetPack: 6.2.2
  • L4T: R36.5
  • Kernel: 5.15.185-tegra (stock /boot/Image, untouched)
  • UEFI: stock NVIDIA UEFI (custom rebuild attempted earlier — same result)

════════════════════════════════════════════════════════════════
GOAL
════════════════════════════════════════════════════════════════
Enable Soft Secure Boot so that:

  1. Boot from external USB / SD with foreign OS is rejected
  2. Modified /boot/Image on the eMMC is rejected
  3. Reversible via UEFI menu (no fuse burning on a Dev Kit)

═══════════════════════════════════════════════════════════════
WHAT I DID
═══════════════════════════════════════════════════════════════

Step 1 — Generated PKI keys on Ubuntu 22.04 build host:
openssl req -newkey rsa:2048 -nodes -keyout PK.key -new -x509 …
openssl req -newkey rsa:2048 -nodes -keyout KEK.key -new -x509 …
openssl req -newkey rsa:2048 -nodes -keyout db.key -new -x509 …

Step 2 — Built auth files via efitools:
cert-to-efi-sig-list -g $GUID PK.crt PK.esl
sign-efi-sig-list -k PK.key -c PK.crt PK PK.esl PK.auth
sign-efi-sig-list -k PK.key -c PK.crt KEK KEK.esl KEK.auth
sign-efi-sig-list -k KEK.key -c KEK.crt db db.esl db.auth

Step 3 — Captured stock kernel:
scp Jetson:/boot/Image /tmp/Image.unsigned
cp /boot/Image /boot/Image.unsigned.bak # safety backup

Step 4 — Verified signed kernel boots BEFORE enrolling keys.
It does. Boot is clean. Then proceeded to enroll.

Step 5 — Enrolled keys on the Jetson (over SSH):
sudo efi-updatevar -f /tmp/db.auth db # OK
sudo efi-updatevar -f /tmp/KEK.auth KEK # OK
sudo efi-updatevar -f /tmp/PK.auth PK # OK — activates Secure Boot

Step 6 — Reboot. ← THIS IS WHERE IT FAILS.

══════════════════════════════════════════════════════════════
FAILURE MODES
══════════════════════════════════════════════════════════════

ATTEMPT 1 — sbsign (standard EFI signing tool):
sbsign --key db.key --cert db.crt --output Image.signed Image.unsigned

sbverify --cert db.crt Image.signed → OK

Result after reboot with Secure Boot active:
→ UEFI Shell appears ("Press ESC in N seconds to skip startup.nsh")
→ No kernel load attempt visible

ATTEMPT 2 — l4t_uefi_sign_image.sh (NVIDIA’s tool):
cp /tmp/Image.unsigned /tmp/Image.l4tsigned
./l4t_uefi_sign_image.sh
–image /tmp/Image.l4tsigned
–key ~/secure_boot_keys/db.key
–cert ~/secure_boot_keys/db.crt
–mode nosplit

Output: “Image.l4tsigned is signed”

Result after reboot with Secure Boot active:
→ Boot loop: NVIDIA splash → black → NVIDIA splash → black → ...
→ No SSH, no DP login

RECOVERY (both cases, worked cleanly):
Power cycle → F11 → Device Manager → Secure Boot Configuration
→ Reset Secure Boot Keys → Save → Reset
→ Device boots normally. Rolled back to Image.unsigned.bak.

══════════════════════════════════════════════════════════════
QUESTIONS
══════════════════════════════════════════════════════════════

  1. What is the correct end-to-end signing workflow for /boot/Image
    on R36.5 / JetPack 6.2.2? Is --mode nosplit correct, or should
    I use --mode split?

  2. Beyond /boot/Image, what else must be signed for the UEFI
    verification chain to succeed?

    • DTBs in /boot/dtb/ ?
    • initrd in /boot ?
    • extlinux.conf entries ?
    • Boot Manager variables ?

  3. Are there gen_uefi_* helper scripts in Linux_for_Tegra/tools/
    intended for this workflow that I missed?

  4. Is efi-updatevar the supported runtime enrollment path on
    Jetson, or is rebuilding UEFI with PK embedded the recommended
    approach?

  5. Is there a known-working step-by-step reference (commands +
    files) for Soft Secure Boot on the AGX Orin Dev Kit at JetPack
    6.2.2 specifically? The R36.4 doc page exists, but the exact
    commands for the signing step are not spelled out.

═════════════════════════════════════════════════════════════
NOT ASKING ABOUT
═════════════════════════════════════════════════════════════

  • Hard Secure Boot / fuse burning (intentionally avoided on Dev Kit)
  • Pre-UEFI (MB1/PSC) — understand this is closed source
  • Disk encryption — separate topic, will pursue separately if needed

Thanks for any pointers — happy to share full logs / commands /
file dumps if helpful.

2

— 🤖 This is an automated AI response. I’m here to help, but please verify important details! —

Based on the provided context, I’ll try to address the questions and concerns raised.

Correct End-to-End Signing Workflow

The correct end-to-end signing workflow for /boot/Image on R36.5 / JetPack 6.2.2 is not explicitly stated in the provided context. However, it can be inferred that the workflow involves generating PKI keys, building auth files using efitools, and signing the kernel image using sbsign or l4t_uefi_sign_image.sh.

Signing Mode

The --mode nosplit option is used in the l4t_uefi_sign_image.sh script, but it’s not clear if this is the correct mode for the Jetson AGX Orin Dev Kit. The context does not provide information on the --mode split option.

UEFI Verification Chain

The UEFI verification chain involves signing the kernel image, DTBs, and initrd. The context does not provide information on signing extlinux.conf entries or Boot Manager variables.

Gen_Uefi_ Helper Scripts*

The context does not mention gen_uefi_* helper scripts in Linux_for_Tegra/tools/ intended for this workflow.

Efi-Updatevar

The context suggests that efi-updatevar is the supported runtime enrollment path on Jetson, but it’s not clear if rebuilding UEFI with PK embedded is the recommended approach.

Known-Working Step-by-Step Reference

There is no known-working step-by-step reference (commands + files) for Soft Secure Boot on the AGX Orin Dev Kit at JetPack 6.2.2 specifically. The R36.4 doc page exists, but the exact commands for the signing step are not spelled out.

Additional Information

The context provides information on the failure modes, including the UEFI Shell appearing and the boot loop. The recovery process involves resetting the Secure Boot Keys in the UEFI menu.

In summary, while the context provides some information on the signing workflow and UEFI verification chain, it does not provide a clear, step-by-step guide for enabling Soft Secure Boot on the Jetson AGX Orin Dev Kit at JetPack 6.2.2. Further investigation and experimentation may be necessary to determine the correct workflow.

— We support team will also look into your issue to have further suggestions soon. please stay tuned. —

5

hello a.amjad1,

here’re bootloader SecureBoot and UEFI SecureBoot.
IIUC, you’re going to enable UEFI secureboot instead of bootloader secureboot, right?
please also note that, UEFI Payload Encryption it uses the key stored in EKB (encrypted key blob), which is flash onto the EKS (encrypted key store) partition.

please check developer guide, UEFI Secure Boot.
here’re steps to enable UEFI Secureboot.

  1. Generate the PK, KEK, db keys
  2. Generate the UEFI Secure Boot DTBO
  3. Create a UEFIKeys Config File
  4. Generate UefiDefaultSecurityKeys.dtbo