Scroll to navigation

PESIGN(1) General Commands Manual PESIGN(1)


pesign - command line tool for signing UEFI applications


pesign [--in=infile | -i infile]
[--out=outfile | -o outfile]
[--certdir=certdir/fR | -n certdir]
[--nss-token=token | -t token]
[--certificate=nickname | -c nickname]
[--force | -f] [--sign | -s] [--hash | -h]
[--digest_type=digest | -d digest]
[--show-signature | -S ] [--remove-signature | -r ]
[--export-pubkey=outkey | -K outkey]
[--export-cert=outcert | -C outcert]
[--ascii-armor | -a] [--daemonize | -D] [--nofork | -N]
[--signature-number=signum | -u signum]


pesign is a command line tool for manipulating signatures and cryptographic digests of UEFI applications.


Specify input binary.

Specify output binary.

Specify nss certificate database directory.

Use the specified NSS token's certificate database.

Use the certificate database entry with the specified nickname for signing.

Overwrite output files. Without this parameter, pesign will refuse to overrite any output files which already exist.

Sign the input binary with the key specified by --certificate.

Display the cryptographic digest of the input binary on standard output.

Use the specified digest in hashing and signing operations. By default, this value is "sha256". Use "--digest_type=help" to list the available digests.

Show information about the signature of the input binary.

Remove the signature section from the binary.

Specify which signature to operate on. This field is zero-indexed.

Export the public key specified by --certificate to outkey

Export the certificate specified by --certificate to outcert

Use ascii armoring on exported certificates.

Spawn a daemon for use with pesign-client(1)

Do not fork when using --daemonize.


If you have a certificate file and private key file, the following steps may be used to sign a PE image:

# Create a pkcs12 file from private key and
# certificate file.
host:~$ openssl pkcs12 -export -out foo_key.p12 \
-inkey signing_key.pem \
-in xyz_cert.x509.pem

# Import pkcs12 file into pesign db
host:~$ pk12util -i foo_key.p12 -d /etc/pki/pesign

# Do the signing
host:~$ pesign -i <input-file> -o <output-file> \
-c <cert nickname> -s

Please note that this is just an example, and that recommended best practice is to always store private keys in a FIPS 140-2 hardware security module, level 2 or higher.



FIPS 140-2


Peter Jones
Thu Jun 21 2012