Secure Boot state
Each time the CSM is booted, log events are created showing whether Secure Boot is enabled or disabled and whether the UEFI variables are up to date. The following is an example of such a log message.
20 2026/04/21 20:39:35.839 UTC MAJOR: SECURITY #2243 Base Card A
"CPM A has booted with a secure-boot status of enabled"
37 2026/04/21 21:07:43.766 UTC MAJOR: SECURITY #2244 Base Card A
"UEFI variable updates required for CPM A"
The status of Secure Boot and UEFI variables is available to view, per CSM, with the show card detail command.
The following Secure Boot X.509v3 certificates and SHA-256 hash UEFI variables can be displayed, per CSM, with the tools>dump>system>security>secure-boot>uefi-vars command:
- Platform Key (PK)
- Key Exchange Key (KEK)
- Allowed Database (DB)
- Disallowed Database (DBx)