Anything signed with these keys will not execute on the system. Formerly trusted keys that have been breached are stored in a disallowed signature database in the UEFI firmware. The public keys are stored in an authorized signature database in the UEFI firmware, and each step in the boot chain validates the signatures of the next step using these keys. Anything not signed by the Microsoft Corporation UEFI CA 2011, Microsoft Windows Production PCA 2011 or SUPERMICRO Product CA 2018 will not be executed on VPC Bare Metal Servers with Secure Boot enabled. This is done by confirming all firmware and OS images loaded on the system are signed by a central Certificate Authority whose private key is stored in the UEFI firmware. Secure Boot verifies the integrity of the system’s firmware and operating system throughout the boot process. Secure Boot enforces firmware and kernel signatures that are loaded during the boot process, while the TPM provides a secure hardware-based crypto-processor that is often used to validate system integrity measurements. Secure Boot and TPM are software- and hardware-based mechanisms used to validate and enforce trust for all software that is to be loaded onto a system. The latest IBM Cloud Bare Metal Servers for VPC features are focused squarely on security by providing customers with the ability to enable Secure Boot and to use a Trusted Platform Module (TPM 2.0). IBM Cloud Bare Metal Servers for VPC have been available for almost a year, and we continue the steady rollout of additional features to ensure bare metal servers meet our customers’ requirements.

Tpm 2.0 and secure boot