CERT-TO-EFI-HASH-LIST(1)

📦
version 1.9.2 · 11 versions
, in alpine 3.23, alpine 3.24, fedora 43

💅 cert-to-efi-hash-list — like, the whole manual but make it make sense 🎀

okay so bestie, welcome to cert-to-efi-hash-list(1), a User Command and honestly? a little icon. it's the tool that takes your openssl certs and turns them into EFI signature hash revocation lists. yes the name is a mouthful, no we're not changing it. iykyk 💖

✨ SYNOPSIS ✨

cert-to-efi-hash-list [-g <guid>][-t <timestamp>][-s <hash>] <crt file>
<efi sig list file>

that's it. that's the whole vibe check. two files in, magic out. 🦋

🌸 DESCRIPTION 🌸

so here's the tea: you hand it an input X509 certificate (in PEM format, obviously, we're not animals) and it converts it into an EFI signature hash list file. and the file contains only that single certificate. one cert, one list, no cap. 💅

it's giving "lowkey simple but highkey important." main character energy fr fr.

👑 OPTIONS 👑

  • -g <guid> — use <guid> as the owner of the signature. this is your little name tag for the key. and if you don't supply it? bestie, you get an all zero guid. (yes, literally all zeros. the beige of guids. 🙈)
  • -s <hash> — use the SHA<hash> hash algorithm. valid values are 256, 384, 512. pick your fighter. ⭐
  • -t <timestamp> — the time of Revocation for the hash signature. and here's the important bit: set it to 0 if not specified, which means revoke for all time. periodt. 🔥
⚠️ ngl this one matters: signature revocation hashes are only implemented in UEFI 2.4 and up. so if your firmware is older than that, this whole thing is gonna be a no from it. 💀

🧚 EXAMPLES 🧚

converting a cert, the classic 💖

to take a standard X509 certificate in PEM format and produce an output EFI signature list file, simply do:

cert-to-efi-hash-list PK.crt PK.esl

slay. done. you ate. 🍓

stacking them up 🫶

note that the format of EFI signature list files is such that they can simply be concatenated to produce a file with multiple signatures:

cat PK1.esl PK2.esl > PK.esl

literally just cat them together. they're built different (built compatible). 🌈

the guid glow-up ✨

so if your platform has a setup mode key manipulation ability, the keys will often only be displayed by GUID. which means if you're planning to manage lots of keys, using the -g option to give your keys recognisable GUIDs will be useful. do future-you a solid, bestie. 👑

💜 SEE ALSO 💜

sign-efi-sig-list(1) — for details on how to create an authenticated update to EFI secure variables when the EFI system is in user mode. go read it, it's the sequel. 😭

okay that's the whole page!! no sections skipped, no flags dropped, we keep every detail around here 💅 this was cert-to-efi-hash-list version 1.9.2, dated August 2025 — so basically recent, so basically relevant. mwah, go forth and hash 🧚💖🌸

📦 where this page comes from