enroll-sb-vars(1)

💖 enroll-sb-vars(1) 💖

okay bestie, welcome to the General Commands Manual page for enroll-sb-vars, and yes we are doing this whole thing together, hand in hand, no skimming, no cap 🫶

---

✨ NAME ✨

enroll-sb-vars — enroll databases and enable secure boot

🌸 SYNOPSIS 🌸

enroll-sb-vars [-l|--loglevel] [--dry-run] [--enroll] [-i|--interactive]
[--ca-subject] [--profile] [--db-cert] [-h|--help] [-V|--version]

🦋 DESCRIPTION 🦋

Enroll databases and enable secure boot. That's the whole vibe. 💅

So here's the tea: this lil utility enrolls your secure boot certificates. By default it peeks at your boot loader (usually shim.efi) and enrolls the CA certificate that was used to sign that boot loader. Cute, right? But plot twist: if your boot loader has multiple signatures, you might have to pick one yourself using --ca-subject. 🙈

Alternatively you can pick a whole set of certificates using --profile. And if you want even more, you can load additional certificates from files using --db-cert. Obsessed with options honestly.

And hello?? You can use dry run mode to verify the utility will do exactly what you want before it actually enrolls the certificates. Test the fit before you buy, bestie. 👑

okay so this part matters, listen up: this needs a recent UEFI firmware version which accepts an unsigned platform key (PK). The config switch (PcdRequireSelfSignedPk) was added to edk2 in 2023. The default for OVMF has been changed in upstream edk2 in 2026 (edk2-stable202605 or newer). When using the qemu variable store (aka -device uefi-vars-x64) you need qemu 11.2 or newer.

Also, this utility is restricted to virtual machines. Not a physical machine situation, just so you know. 💀

---

👑 OPTIONS 👑

• -l, --loglevel <LEVEL> [default: info] — set loglevel. that's it. that's the whole thing.
• --dry-run — dry run mode.

List the certificates which would be enrolled without actually updating the UEFI secure boot configuration. It's giving window shopping. 🛍️

• --enroll <MODE> [default: redhat] — select PK enroll mode.

Possible values:

• mgmt: EFI_CERT_EXTERNAL_MANAGEMENT_GUID
• redhat: Red Hat Secure Boot (PK/KEK key 1)
• microsoft: Windows OEM Devices PK

• -i, --interactive — enable interactive db certificate selection. you get to choose! main character energy fr fr ✨
• --ca-subject <CN> — select db boot loader certificate.

Might be needed if your boot loader has multiple signatures to specify which signature CA should be used. Yeah. We covered this. Pick your fighter. 🥊

• --profile <NAME> — select db certificate profile.

For linux systems you usually need uefi11 or uefi23. (iykyk)

Possible values:

• none: no certificates
• win11: Windows CA certificates, 2011 + 2023
• win23: Windows CA certificate, 2023 only
• win+rom23: Windows CA + Option ROM certificates, 2023 only
• uefi11: UEFI CA certificates, 2011 + 2023
• uefi23: UEFI CA certificate, 2023
• uefi+rom23: UEFI CA + Option ROM certificates, 2023
• redhat: Red Hat UEFI CA certificate
• redhat+rom: Red Hat UEFI CA + Option ROM certificates
• all: Both Windows and UEFI CA certificates, 2011 + 2023

• --db-cert <FILE> — add certificate to db.

Can be specified multiple times. Certificates will be enrolled in addition to the other certificates. Use --profile none if you want specify all certificates explicitly. stacking them like a lil collection 🎀

• -h, --help — Print help (see a summary with -h). yes, it says "see a summary with -h". we don't make the rules.
• -V, --version — Print version. slay.

---

⭐ VERSION ⭐

v0.1.14

---

and that's a wrap, bestie!! 🎀✨ this page is from the enroll-sb-vars 0.1.14 era, enroll-sb-vars(1), General Commands Manual — go forth and enroll responsibly 💖🦋🌸