where is the "server certificate" located on the pc? #6967

jringoot · 2024-03-18T12:28:23Z

jringoot
Mar 18, 2024

Describe the question
where is the "server certificate" located on the pc?

I have several debian 12 machines.
on one of them, which is fully up to date accoring to apt
I get

fwupdmgr --force refresh
Updating lvfs
Downloading…             [     \                                 ]
failed to download file: server certificate verification failed. CAfile: none CRLfile: none

on other machines (although one other as well)

I get as expected:

fwupdmgr --force refresh
WARNING: UEFI ESP partition not detected or configured
See https://github.com/fwupd/fwupd/wiki/PluginFlag:esp-not-found for more information.
WARNING: Will measure elements of system integrity around an update
See https://github.com/fwupd/fwupd/wiki/PluginFlag:measure-system-integrity for more information.
Updating lvfs
Downloading…             [***************************************]
Successfully downloaded new metadata: 2 local devices supported

fwupd version information
Please provide the version of the daemon and client if applicable to your current installation of fwupd.

apt info fwupd
Package: fwupd
Version: 1.8.12-2
Priority: optional
Section: admin
Maintainer: Debian EFI <debian-efi@lists.debian.org>
Installed-Size: 6,985 kB
Provides: fwupdate
Depends: libarchive13 (>= 3.2.1), libc6 (>= 2.34), libcbor0.8 (>= 0.8.0), libcurl3-gnutls (>= 7.63.0), libefiboot1 (>= 37), libflashrom1 (>= 1.3.0), libfwupd2 (>= 1.8.11), libgcab-1.0-0 (>= 1.5), libglib2.0-0 (>= 2.70.0), libgnutls30 (>= 3.7.3), libgudev-1.0-0 (>= 212), libgusb2 (>= 0.3.8), libjcat1 (>= 0.1.3), libjson-glib-1.0-0 (>= 1.5.2), liblzma5 (>= 5.1.1alpha+20120614), libmbim-glib4 (>= 1.28.0), libmbim-proxy, libmm-glib0 (>= 1.10.0), libpolkit-gobject-1-0 (>= 0.99), libprotobuf-c1 (>= 1.3.1), libqmi-glib5 (>= 1.18.0), libqmi-proxy, libsmbios-c2, libsqlite3-0 (>= 3.6.1), libsystemd0, libtss2-esys-3.0.2-0 (>= 2.3.1), libxmlb2 (>= 0.3.2), adduser, shared-mime-info
Recommends: python3, bolt, dbus, secureboot-db, udisks2, fwupd-signed, jq
Suggests: gir1.2-fwupd-2.0
Conflicts: fwupdate-amd64-signed, fwupdate-arm64-signed, fwupdate-armhf-signed, fwupdate-i386-signed
Breaks: fwupdate (<< 12-7), gir1.2-dfu-1.0 (<< 0.9.7-1), libdfu-dev (<< 0.9.7-1), libdfu1 (<< 0.9.7-1)
Replaces: fwupdate (<< 12-7), gir1.2-dfu-1.0 (<< 0.9.7-1), libdfu-dev (<< 0.9.7-1), libdfu1 (<< 0.9.7-1)
Homepage: https://github.com/fwupd/fwupd
Download-Size: 2,845 kB
APT-Manual-Installed: no
APT-Sources: http://deb.debian.org/debian bookworm/main amd64 Packages
Description: Firmware update daemon
 fwupd is a daemon to allow session software to update device firmware.
 You can either use a GUI software manager like GNOME Software to view and
 apply updates, the command-line tool or the system D-Bus interface directly.
 Firmware updates are supported for a variety of technologies.
 See <https://github.com/fwupd/fwupd> for details

fwupdmgr --version
compile   org.freedesktop.fwupd         1.8.12
compile   com.hughsie.libxmlb           0.3.10
compile   com.hughsie.libjcat           0.1.9
runtime   org.freedesktop.fwupd-efi     1.4
compile   org.freedesktop.gusb          0.3.10
runtime   com.dell.libsmbios            2.4
runtime   org.freedesktop.gusb          0.3.10
runtime   org.freedesktop.fwupd         1.8.12
runtime   org.kernel                    6.1.0-18-amd64

Answered by jringoot

Mar 30, 2024

@superm1 apparently the snap is 1.9.15 and runs fast.

thanks for the help

View full answer

hughsie · 2024-03-18T13:02:36Z

hughsie
Mar 18, 2024
Maintainer

server certificate verification failed. CAfile: none CRLfile: none

I don't think this is fwupd related, I think you'd have the same error when using curl https://people.freedesktop.org/~hughsient/temp/minifig.png on the CLI.

1 reply

jringoot Mar 28, 2024
Author

no, but thanks

root@mycomputer:~#  curl https://people.freedesktop.org/~hughsient/temp/minifig.png
Warning: Binary output can mess up your terminal. Use "--output -" to tell 
Warning: curl to output it to your terminal anyway, or consider "--output 
Warning: <FILE>" to save to a file.
root@mycomputer:~#  curl https://people.freedesktop.org/~hughsient/temp/minifig.png --output ./minifig.png
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  260k  100  260k    0     0   237k      0  0:00:01  0:00:01 --:--:--  238k
root@mycomputer:~#

superm1 · 2024-03-18T17:15:59Z

superm1
Mar 18, 2024
Maintainer

This is more likely a missing CA certs package or wrong time on your clock.

2 replies

jringoot Mar 28, 2024
Author

Time looks fine

root@mycomputer:~# ntpdate ntp.oma.be
2024-03-28 14:22:33.315415 (+0100) +0.000117 +/- 0.009440 ntp.oma.be 193.190.230.105 s2 no-leap
root@mycomputer:~#

a missing CA cerificates package? I will try to verify that.

jringoot Mar 28, 2024
Author

reinstalled CA certificates

root@mycomputer:~# apt-get install --reinstall ca-certificates 
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
  linux-image-6.1.0-12-amd64 linux-image-6.1.0-13-amd64 linux-image-6.1.0-15-amd64
Use 'apt autoremove' to remove them.
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 93 not upgraded.
Need to get 153 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://deb.debian.org/debian bookworm/main amd64 ca-certificates all 20230311 [153 kB]
Fetched 153 kB in 0s (1,211 kB/s)       
Preconfiguring packages ...
(Reading database ... 287868 files and directories currently installed.)
Preparing to unpack .../ca-certificates_20230311_all.deb ...
Unpacking ca-certificates (20230311) over (20230311) ...
Setting up ca-certificates (20230311) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Processing triggers for man-db (2.11.2-2) ...
Processing triggers for ca-certificates (20230311) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
Processing triggers for ca-certificates-java (20230710~deb12u1) ...
done.
root@mycomputer:~#

still same issue:

root@mycomputer:~# fwupdmgr --verbose
(fwupdmgr:10701): GLib-DEBUG: 14:24:33.780: setenv()/putenv() are not thread-safe and should not be used after threads are created
(pkttyagent:10703): GLib-GIO-DEBUG: 14:24:33.784: Using cross-namespace EXTERNAL authentication (this will deadlock if server is GDBus < 2.73.3)
(fwupdmgr:10701): GLib-GIO-DEBUG: 14:24:33.790: _g_io_module_get_default: Found default implementation dconf (DConfSettingsBackend) for ‘gsettings-backend’
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_fast: "/system/proxy/" (establishing: 0, active: 0)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_fast: "/system/proxy/http/" (establishing: 0, active: 0)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_fast: "/system/proxy/https/" (establishing: 0, active: 0)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_fast: "/system/proxy/ftp/" (establishing: 0, active: 0)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_fast: "/system/proxy/socks/" (establishing: 0, active: 0)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: unwatch_fast: "/system/proxy/" (active: 0, establishing: 1)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: unwatch_fast: "/system/proxy/http/" (active: 0, establishing: 1)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: unwatch_fast: "/system/proxy/https/" (active: 0, establishing: 1)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: unwatch_fast: "/system/proxy/ftp/" (active: 0, establishing: 1)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: unwatch_fast: "/system/proxy/socks/" (active: 0, establishing: 1)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_established: "/system/proxy/" (establishing: 0)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_established: "/system/proxy/http/" (establishing: 0)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_established: "/system/proxy/https/" (establishing: 0)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_established: "/system/proxy/ftp/" (establishing: 0)
(fwupdmgr:10701): dconf-DEBUG: 14:24:33.790: watch_established: "/system/proxy/socks/" (establishing: 0)
(fwupdmgr:10701): GLib-GIO-DEBUG: 14:24:33.804: _g_io_module_get_default: Found default implementation libproxy (GLibproxyResolver) for ‘gio-proxy-resolver’
(fwupdmgr:10701): GLib-GIO-DEBUG: 14:24:33.805: Using cross-namespace EXTERNAL authentication (this will deadlock if server is GDBus < 2.73.3)
Failed to connect to daemon: Error calling StartServiceByName for org.freedesktop.fwupd: Failed to activate service 'org.freedesktop.fwupd': timed out (service_start_timeout=25000ms)
root@mycomputer:~#

jringoot · 2024-03-28T13:22:20Z

jringoot
Mar 28, 2024
Author

fwupdmgr --verbose
(fwupdmgr:4855): GLib-DEBUG: 14:14:50.963: setenv()/putenv() are not thread-safe and should not be used after threads are created
(pkttyagent:4857): GLib-GIO-DEBUG: 14:14:50.970: Using cross-namespace EXTERNAL authentication (this will deadlock if server is GDBus < 2.73.3)
(fwupdmgr:4855): GLib-GIO-DEBUG: 14:14:50.977: _g_io_module_get_default: Found default implementation dconf (DConfSettingsBackend) for ‘gsettings-backend’
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.977: watch_fast: "/system/proxy/" (establishing: 0, active: 0)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.977: watch_fast: "/system/proxy/http/" (establishing: 0, active: 0)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.977: watch_fast: "/system/proxy/https/" (establishing: 0, active: 0)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.977: watch_fast: "/system/proxy/ftp/" (establishing: 0, active: 0)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.977: watch_fast: "/system/proxy/socks/" (establishing: 0, active: 0)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.977: unwatch_fast: "/system/proxy/" (active: 0, establishing: 1)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.977: unwatch_fast: "/system/proxy/http/" (active: 0, establishing: 1)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.977: unwatch_fast: "/system/proxy/https/" (active: 0, establishing: 1)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.977: unwatch_fast: "/system/proxy/ftp/" (active: 0, establishing: 1)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.978: unwatch_fast: "/system/proxy/socks/" (active: 0, establishing: 1)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.978: watch_established: "/system/proxy/" (establishing: 0)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.978: watch_established: "/system/proxy/http/" (establishing: 0)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.978: watch_established: "/system/proxy/https/" (establishing: 0)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.978: watch_established: "/system/proxy/ftp/" (establishing: 0)
(fwupdmgr:4855): dconf-DEBUG: 14:14:50.978: watch_established: "/system/proxy/socks/" (establishing: 0)
(fwupdmgr:4855): GLib-GIO-DEBUG: 14:14:50.995: _g_io_module_get_default: Found default implementation libproxy (GLibproxyResolver) for ‘gio-proxy-resolver’
(fwupdmgr:4855): GLib-GIO-DEBUG: 14:14:50.996: Using cross-namespace EXTERNAL authentication (this will deadlock if server is GDBus < 2.73.3)
Failed to connect to daemon: Error calling StartServiceByName for org.freedesktop.fwupd: Failed to activate service 'org.freedesktop.fwupd': timed out (service_start_timeout=25000ms)
root@nyarlathotep:~#

0 replies

jringoot · 2024-03-28T13:32:07Z

jringoot
Mar 28, 2024
Author

root@mycomputer:~# systemctl status fwupd
× fwupd.service - Firmware update daemon
     Loaded: loaded (/lib/systemd/system/fwupd.service; static)
     Active: failed (Result: timeout) since Thu 2024-03-28 14:27:33 CET; 20s ago
       Docs: https://fwupd.org/
    Process: 10714 ExecStart=/usr/libexec/fwupd/fwupd (code=killed, signal=TERM)
   Main PID: 10714 (code=killed, signal=TERM)
        CPU: 665ms

Mar 28 14:24:33 mycomputer systemd[1]: Starting fwupd.service - Firmware update daemon...
Mar 28 14:27:33 mycomputer systemd[1]: fwupd.service: start operation timed out. Terminating.
Mar 28 14:27:33 mycomputer systemd[1]: fwupd.service: Failed with result 'timeout'.
Mar 28 14:27:33 mycomputer systemd[1]: Failed to start fwupd.service - Firmware update daemon.
root@mycomputer:~# systemctl start fwupd
Job for fwupd.service failed because a timeout was exceeded.
See "systemctl status fwupd.service" and "journalctl -xeu fwupd.service" for details.
root@mycomputer:~#

0 replies

jringoot · 2024-03-28T13:34:15Z

jringoot
Mar 28, 2024
Author

root@mycomputer:~# journalctl -xeu fwupd.service
░░ Subject: A start job for unit fwupd.service has begun execution
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit fwupd.service has begun execution.
░░ 
░░ The job identifier is 4013.
Mar 28 14:27:33 mycomputer systemd[1]: fwupd.service: start operation timed out. Terminating.
Mar 28 14:27:33 mycomputer systemd[1]: fwupd.service: Failed with result 'timeout'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ The unit fwupd.service has entered the 'failed' state with result 'timeout'.
Mar 28 14:27:33 mycomputer systemd[1]: Failed to start fwupd.service - Firmware update daemon.
░░ Subject: A start job for unit fwupd.service has failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit fwupd.service has finished with a failure.
░░ 
░░ The job identifier is 4013 and the job result is failed.
Mar 28 14:27:59 mycomputer systemd[1]: Starting fwupd.service - Firmware update daemon...
░░ Subject: A start job for unit fwupd.service has begun execution
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit fwupd.service has begun execution.
░░ 
░░ The job identifier is 4122.
Mar 28 14:30:59 mycomputer systemd[1]: fwupd.service: start operation timed out. Terminating.
Mar 28 14:30:59 mycomputer systemd[1]: fwupd.service: Failed with result 'timeout'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ The unit fwupd.service has entered the 'failed' state with result 'timeout'.
Mar 28 14:30:59 mycomputer systemd[1]: Failed to start fwupd.service - Firmware update daemon.
░░ Subject: A start job for unit fwupd.service has failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit fwupd.service has finished with a failure.
░░ 
░░ The job identifier is 4122 and the job result is failed.
lines 71-115/115 (END)

0 replies

jringoot · 2024-03-28T15:10:08Z

jringoot
Mar 28, 2024
Author

apparently when the service is started manually, it is very slow, it took more than 6 minutes to start : the difference between the first and the last timestamp of this command was slightly more than 6 minutes

/usr/libexec/fwupd/fwupd --verbose &

While on another computer it took less than 2 minutes

The last message is: always:
$TIMESTAMP FuEngine writing motd target /var/cache/fwupd/motd.d/85-fwupd
But running service with the above command, instead of with systemctl, it keeps running and I was able to do the firmware updates.

The systemctl probably cuts off the process, we can see that in the timeout message we get when we run

journalctl -xeu fwupd.service

see above

0 replies

jringoot · 2024-03-28T15:14:13Z

jringoot
Mar 28, 2024
Author

The object was to get the firmware update, that's resolved, the pc has 7 years and had the updates from debian 9, over 10, 11 and finally debian 12 and it still works.

The best option would be either to accept that the fwupd must be started manually, or search how to increase the timeout for this systemctl startup script

5 replies

jringoot Mar 30, 2024
Author

@superm1 sorry, I don't feel like making it into a testing machine.
This is the part that took long:
21:51:17.578 FuDevice using 5fed1486be004d67ea79838d2e83aaa11bb72645 for PCI_SLOT_NAME=0000:00:16.0
21:51:17.588 FuDevice using 230c8b18-8d9b-53ec-838b-6cfc0383493a for main-system-firmware
21:51:17.592 FuDevice using 1d10887a051b3991a3314f760163248231628504 for PCI_SLOT_NAME=0000:00:16.0:MKHI
21:54:37.666 FuPluginIntelMe failed to get public key using /fpf/OemCred: write failed on timeout with status
21:54:37.716 FuPlugin fu_plugin_device_created(thunderbolt)
21:54:37.716 FuIdle inhibiting: thunderbolt requires device wakeup
21:54:37.720 FuDevice using 98d13e91303e2ebc6429ef000f710219827ea158 for c9030000-0082-8088-20be-6612d4223821
21:54:37.760 FuPlugin emit added from thunderbolt: 98d13e91303e2ebc6429ef000f710219827ea158
2

superm1 Mar 30, 2024
Maintainer

Can you clone the repo and run in the fwupd development environment?

jringoot Mar 30, 2024
Author

@superm1 I downloaded the repo as zip, but I could not find a binary in it

jringoot Mar 30, 2024
Author

@superm1 apparently the snap is 1.9.15 and runs fast.

thanks for the help

Answer selected by superm1

jringoot · 2024-03-30T23:25:36Z

jringoot
Mar 30, 2024
Author

I attach the full log here
fwupd2.log

0 replies

jringoot · 2024-03-30T23:40:51Z

jringoot
Mar 30, 2024
Author

just tried the snap

snap info fwupd
name:      fwupd
summary:   Firmware updates for Linux
publisher: Richard Hughes
store-url: https://snapcraft.io/fwupd
contact:   https://github.com/fwupd/fwupd
license:   LGPL-2.1+
description: |
  The full fwupd firmware updating stack for Linux.  Can be used to perform updates on all supported
  devices via https://fwupd.org
commands:
  - fwupd.fwupdmgr
  - fwupd.fwupdtool
services:
  fwupd: dbus, enabled, inactive
snap-id:      HpOj37PuyuaMUZY0NQhtwnp7oS5P8u5R
tracking:     latest/stable
refresh-date: today at 00:33 CET
channels:
  latest/stable:    1.9.15                2024-03-15 (5793) 23MB -
  latest/candidate: 1.9.15                2024-03-15 (5793) 23MB -
  latest/beta:      ↑                                            
  latest/edge:      1.9.10-640-g96cc2c6bc 2024-03-29 (5886) 24MB -
  1.9.x/stable:     1.9.15                2024-03-15 (5793) 23MB -
  1.9.x/candidate:  1.9.15                2024-03-11 (5793) 23MB -
  1.9.x/beta:       ↑                                            
  1.9.x/edge:       1.9.15-66-gad2aec9b3  2024-03-29 (5887) 23MB -
installed:          1.9.15                           (5793) 23MB -


 /snap/fwupd/current/libexec/fwupd/fwupd --verbose
/snap/fwupd/current/libexec/fwupd/fwupd: error while loading shared libraries: libfwupdengine.so: cannot open shared object file: No such file or directory

8 replies

jringoot Mar 30, 2024
Author

 fwupd.fwupdtool --verbose
23:46:52.352 FuDebug              verbose to info (on console 1)
23:46:52.358 FuEngine             starting fwupd 1.9.15…
Command not found
Use fwupdtool --help for help

jringoot Mar 30, 2024
Author

 fwupd.fwupdtool  refresh
Loading…                 [******************                     ]23:47:43.689 FuEngine             failed to add device /sys/devices/pci0000:00/0000:00:16.0/0000:00:16.0-8e6a6715-9abc-4043-88ef-9e39c6f63e0f: ioctl error: Device or resource busy [16]
Loading…                 [**********************                 ]ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: Operation not permitted 
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 
Loading…                 [**************************             ]23:47:43.988 FuEngine             failed to add device /sys/devices/virtual/msr/msr0: failed to add device using on msr: failed to open /dev/cpu/0/msr: Operation not permitted
Downloading…             [************************************** ]

jringoot Mar 30, 2024
Author

 fwupd.fwupdtool  get-updates
Loading…                 [******************                     ]23:49:03.250 FuPluginIntelMe      failed to get public key using /fpf/OemCred: write failed on timeout with status
Loading…                 [**********************                 ]ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: Operation not permitted 
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 
Loading…                 [**************************             ]23:49:03.626 FuEngine             failed to add device /sys/devices/virtual/msr/msr0: failed to add device using on msr: failed to open /dev/cpu/0/msr: Operation not permitted
Loading…                 [************************************** ]
Devices with no available firmware updates: 
 • USB2.0 Hub
 • USB2.0 Hub
 • USB3.1 Hub
 • USB3.1 Hub
 • UEFI Device Firmware
Devices with the latest available firmware version:
 • Embedded Controller
 • LENSE20256GMSP34MEAT2TA
 • System Firmware
 • Thunderbolt host controller
LENOVO 20L8S3BU00
│
└─UEFI dbx:
  │   Device ID:          362301da643102b9f38477387e2193e57abaa590
  │   Summary:            UEFI revocation database
  │   Current version:    77
  │   Minimum Version:    77
  │   Vendor:             UEFI:Linux Foundation
  │   Install Duration:   1 second
  │   GUIDs:              5971a208-da00-5fce-b5f5-1234342f9cf7 ← UEFI\CRT_A9087D1044AD18F7A94916D284CBC01827CF23CD8F60B79072C9CAA1FEF4D649&ARCH_X64
  │                       f8ba2887-9411-5c36-9cee-88995bb39731 ← UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503&ARCH_X64
  │   Device Flags:       • Internal device
  │                       • Updatable
  │                       • Supported on remote server
  │                       • Needs a reboot after installation
  │                       • Device is usable for the duration of the update
  │                       • Only version upgrades are allowed
  │                       • Signed Payload
  │ 
  ├─Secure Boot dbx Configuration Update:
  │     New version:      371
  │     Remote ID:        lvfs
  │     Release ID:       35287
  │     Summary:          UEFI Secure Boot Forbidden Signature Database
  │     Variant:          x64
  │     License:          Proprietary
  │     Size:             21.2 kB
  │     Created:          2023-05-09
  │     Urgency:          High
  │     Tested by Wistron:
  │       Tested:         2024-03-26
  │       Distribution:   ubuntu 22.04
  │       Old version:    267
  │       Version[fwupd]: 1.9.15
  │     Tested by HP:
  │       Tested:         2024-03-21
  │       Distribution:   fedora 39 (workstation)
  │       Old version:    217
  │       Version[fwupd]: 1.9.15
  │     Tested by Lenovo:
  │       Tested:         2024-02-20
  │       Distribution:   fedora 39 (workstation)
  │       Old version:    77
  │       Version[fwupd]: 1.9.5
  │     Tested by Lenovo:
  │       Tested:         2024-01-12
  │       Distribution:   fedora 39 (workstation)
  │       Old version:    220
  │       Version[fwupd]: 1.9.11
  │     Tested by DMC Group:
  │       Tested:         2023-07-11
  │       Distribution:   fedora 38 (workstation)
  │       Old version:    211
  │       Version[fwupd]: 1.9.2
  │     Tested by Jabra:
  │       Tested:         2023-07-03
  │       Distribution:   ubuntu 22.04
  │       Old version:    220
  │       Version[fwupd]: 1.9.3
  │     Vendor:           Linux Foundation
  │     Duration:         1 second
  │     Release Flags:    • Trusted metadata
  │                       • Is upgrade
  │     Description:      
  │     Insecure versions of the Microsoft Windows boot manager affected by Black Lotus were added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.
  │     
  │     Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.Applying this update may also cause some Windows install media to not start correctly.
  │     Issue:            CVE-2022-21894
  │     Checksum:         fc3feb015df2710fcfa07583d31b5975ee398357016699cfff067f422ab91e13
  │   
  ├─Secure Boot dbx Configuration Update:
  │     New version:      220
  │     Remote ID:        lvfs
  │     Release ID:       28499
  │     Summary:          UEFI Secure Boot Forbidden Signature Database
  │     Variant:          x64
  │     License:          Proprietary
  │     Size:             13.9 kB
  │     Created:          2023-03-14
  │     Urgency:          High
  │     Vendor:           Linux Foundation
  │     Duration:         1 second
  │     Release Flags:    • Trusted metadata
  │                       • Is upgrade
  │     Description:      
  │     Insecure versions of software from Trend Micro, vmware, CPSD, Eurosoft, and New Horizon Datasys Inc were added to the list of forbidden signatures due to discovered security problems.This updates the dbx to the latest release from Microsoft.
  │     
  │     Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.
  │     Issue:            CVE-2023-28005
  │     Checksum:         4016aca8f305115c1015c9c6079d855832f8ae8cc231f412990e4e8f9ed1bfc2
  │   
  ├─Secure Boot dbx Configuration Update:
  │     New version:      217
  │     Remote ID:        lvfs
  │     Release ID:       15179
  │     Summary:          UEFI Secure Boot Forbidden Signature Database
  │     Variant:          x64
  │     License:          Proprietary
  │     Size:             13.8 kB
  │     Created:          2020-07-29
  │     Urgency:          High
  │     Vendor:           Linux Foundation
  │     Duration:         1 second
  │     Release Flags:    • Trusted metadata
  │                       • Is upgrade
  │     Description:      
  │     This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.
  │     
  │     Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.If the installation fails, you will need to update shim and grub packages before the update can be deployed.
  │     
  │     Once you have installed this dbx update, any DVD or USB installer images signed with the old signatures may not work correctly.You may have to temporarily turn off secure boot when using recovery or installation media, if new images have not been made available by your distribution.
  │     Issues:           309662
  │                       CVE-2022-34303
  │                       CVE-2022-34302
  │                       CVE-2022-34301
  │     Checksum:         89132cb7d779c67dfc13e97d0051eb6c26c6bcad44e069307e06ded01f154ba5
  │   
  └─Secure Boot dbx Configuration Update:
        New version:      211
        Remote ID:        lvfs
        Release ID:       15178
        Summary:          UEFI Secure Boot Forbidden Signature Database
        Variant:          x64
        License:          Proprietary
        Size:             13.5 kB
        Created:          2021-04-29
        Urgency:          High
        Vendor:           Linux Foundation
        Duration:         1 second
        Release Flags:    • Trusted metadata
                          • Is upgrade
        Description:      
        This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.
        Checksum:         4a37b2330c11801482f59379fcbd27acd92ded627990f719b5116e6ab74ca274

jringoot Mar 30, 2024
Author

fwupd.fwupdtool  update
Loading…                 [******************                     ]23:54:44.280 FuPluginIntelMe      failed to get public key using /fpf/OemCred: write failed on timeout with status
Loading…                 [**********************                 ]ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: Operation not permitted 
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 
Loading…                 [**************************             ]23:54:44.617 FuEngine             failed to add device /sys/devices/virtual/msr/msr0: failed to add device using on msr: failed to open /dev/cpu/0/msr: Operation not permitted
Loading…                 [************************************** ]
Devices with no available firmware updates: 
 • USB2.0 Hub
 • USB2.0 Hub
 • USB3.1 Hub
 • USB3.1 Hub
 • UEFI Device Firmware
Devices with the latest available firmware version:
 • Embedded Controller
 • LENSE20256GMSP34MEAT2TA
 • System Firmware
 • Thunderbolt host controller
 • UEFI dbx

jringoot Mar 30, 2024
Author

fwupd.fwupdtool  --version
Loading…                 [************************************** ]
compile   org.freedesktop.fwupd         1.9.15
compile   com.hughsie.libxmlb           0.3.6
compile   io.snapcraft.fwupd            5793
compile   com.hughsie.libjcat           0.1.9
runtime   org.freedesktop.fwupd-efi     1.4
compile   org.freedesktop.gusb          0.3.10
runtime   org.freedesktop.gusb          0.3.10
runtime   org.freedesktop.fwupd         1.9.15
runtime   org.kernel                    6.1.0-17-amd64

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

where is the "server certificate" located on the pc? #6967

{{title}}

Replies: 9 comments 16 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

where is the "server certificate" located on the pc? #6967

jringoot Mar 18, 2024

Replies: 9 comments · 16 replies

hughsie Mar 18, 2024 Maintainer

jringoot Mar 28, 2024 Author

superm1 Mar 18, 2024 Maintainer

jringoot Mar 28, 2024 Author

jringoot Mar 28, 2024 Author

jringoot Mar 28, 2024 Author

jringoot Mar 28, 2024 Author

jringoot Mar 28, 2024 Author

jringoot Mar 28, 2024 Author

jringoot Mar 28, 2024 Author

jringoot Mar 30, 2024 Author

superm1 Mar 30, 2024 Maintainer

jringoot Mar 30, 2024 Author

jringoot Mar 30, 2024 Author

jringoot Mar 30, 2024 Author

jringoot Mar 30, 2024 Author

jringoot Mar 30, 2024 Author

jringoot Mar 30, 2024 Author

jringoot Mar 30, 2024 Author

jringoot Mar 30, 2024 Author

jringoot Mar 30, 2024 Author

jringoot
Mar 18, 2024

Replies: 9 comments 16 replies

hughsie
Mar 18, 2024
Maintainer

jringoot Mar 28, 2024
Author

superm1
Mar 18, 2024
Maintainer

jringoot Mar 28, 2024
Author

jringoot Mar 28, 2024
Author

jringoot
Mar 28, 2024
Author

jringoot
Mar 28, 2024
Author

jringoot
Mar 28, 2024
Author

jringoot
Mar 28, 2024
Author

jringoot
Mar 28, 2024
Author

jringoot Mar 30, 2024
Author

superm1 Mar 30, 2024
Maintainer

jringoot Mar 30, 2024
Author

jringoot Mar 30, 2024
Author

jringoot
Mar 30, 2024
Author

jringoot
Mar 30, 2024
Author

jringoot Mar 30, 2024
Author

jringoot Mar 30, 2024
Author

jringoot Mar 30, 2024
Author

jringoot Mar 30, 2024
Author

jringoot Mar 30, 2024
Author