Users Guide

Validate OS10 image before manual installation from ONIE
When you manually install an OS10 image using ONIE, you can validate the image using hash-based authentication (sha256) or
digital certificates (PKI-signed).
The signature for the OS10 installer image is provided with the downloaded OS10 .tar file. You can extract the OS10 binary file
image from the .tar file and install it from a local server. For more information, see Download OS10 image and Installation using
ONIE.
To validate and install an image using the X.509v3 certificate and OS10 image signature, use the onie-nos-install
command during a manual installation. For more information, see Manual installation; for example:
$ onie-nos-install image_url pki signature_filepath certificate_filepath
Or
$ onie-nos-install image_url sha256 signature_filepath
The OS10 image installer verifies the signature of the image files using hash-based authentication or digital signatures (PKI-
signed). The image files are installed after they are successfully validated.
View certificate information
Use the show secure-boot pki-certificates command in EXEC mode to view the certificate information.
When working with CA certificates, view the certificate information using the show secure-boot pki-certificates
command in EXEC mode.
OS10# show secure-boot pki-certificates
Certificate Key Id : 123
Version Number : 3 (0x2)
Serial Number : 17154672033164819608 (0xee11a353271dfc98)
Signature Algorithm : sha256WithRSAEncryption
Issuer : C=IN, ST=Some-State, L=some-city, O=Internet Widgits Pty Ltd
Validity : Aug 1 11:45:39 2019 GMT - Jul 31 11:45:39 2020 GMT
Certificate Key Id : 124
Version Number : 3 (0x2)
Serial Number : 17154672033164819608 (0xee11a353271dfc98)
Signature Algorithm : sha256WithRSAEncryption
Issuer : C=IN, ST=Some-State, L=some-city, O=Internet Widgits Pty Ltd
Validity : Aug 1 11:45:39 2019 GMT - Jul 31 11:45:39 2020 GMT
Revoke an installed key
If either the public key or private key used in CA certificates is compromised, revoke the key by using the revoke key
command in EXEC mode.
For key-id, enter the local file path where the downloaded or locally generated private key is stored.
OS10# revoke key key-id
The key is moved to the Revoked state.
Recover from image validation failures
This section explains how to recover from image validation failures and provides the recovery steps for the various failure
scenarios.
Secure boot validates both the installed images. If validation fails for one of the images, you can install the other image. If
validation fails for both the images, reinstall the OS10 image from ONIE.
OS10 kernel validation fails for one installed OS10 image
If kernel validation fails, the system enters GRUB mode. To recover from this validation failure:
1. Select the other installed OS10 image from the GRUB menu.
1334
Security