SIG-LIST-TO-CERTS(1)

🌸 NAME 🌸

okay so welcome to SIG-LIST-TO-CERTS(1), bestie — a User Command and the literal tool for converting EFI signature lists back to openssl certificates. no cap, that’s the whole vibe 💅✨

✨ SYNOPSIS ✨

sig-list-to-certs <efi sig list file> <cert file base name>

💖 DESCRIPTION 💖

It takes <efi sig list file> and converts it to a set of DER format openssl certificates in <cert file base name>.n (where n runs from 0 to the number of certificates in the file). that’s it, that’s the magic 🫶

🎀 EXAMPLES 🎀

okay so to see what certificates your UEFI system currently has, you can run the dmpstore command to print them to a file:

dmpstore PK > PK.uc16

this file isn’t readily readable on a standard unix system because it’s in UC-16 format, so convert it to ordinary text:

iconv -f utf-16 PK.uc16 > PK.txt

now remove the header which says something like:

 Dump Variable pk
 Variable NV+RT+BS 'Efi:PK' DataSize = 2DA

leaving only the hex dump. this can then be converted to an EFI signature list by xxd:

xxd -r PK.txt > PK.esl

and you can now extract openssl readable certificates from this:

sig-list-to-certs PK.esl PK

which will print some information like:

 X509 Header sls=730, header=0, sig=686
 file PK.0: Guid 77fa9abd-0359-4d32-4d60-28f4e78f784b
 Written 686 bytes

and finally, you can see the certificate in text format:

openssl x509 -text -inform DER -in PK.0

assuming it’s an X509 certificate 💖

---

okay that’s the whole page bestie 🫶 — SIG-LIST-TO-CERTS(1) is a User Command, the source/version footer vibe is Usage: ./sig-list-to-certs <ef..., and it’s dated August 2025. byeee 💅✨