XenCenter

Secure Boot Certificates

For UEFI Secure Boot enabled VMs, XenCenter® indicates the status of the Secure Boot certificates, and allows for updates where available, for example to remediate certificate expiry.

For more information on UEFI Secure Boot certificate remediation, please review the appropriate XenServer 8.4 or XenServer 9 documentation.

Review certificate state in XenCenter

You can review the certificate state for a specific VM or template using the following process:

  1. In the left panel, choose the VM or template you wish to check.

  2. On the General tab, expand the Boot Options section.

  3. Review the Secure boot certificates field:

    • Update available - The VM is eligible for remediation and can be flagged for update on the next boot.

    • OK - The VM does not require remediation.

    • Update flagged - The VM is scheduled for certificate update on the next boot.

You can also use the search functionality to identify VMs where an update is available using the following process:

  1. Start a new search.

  2. Select to search for VMs.

  3. Select to filter on Secure Boot Certificates

  4. Select the Update available value

Flag or unflag VMs for certificate update

To flag one or more VMs for certificate update at their next boot, use the following process:

  1. In the left panel, choose the VM or VMs that you wish to flag for certificate update.

  2. From the main menu, select VM, then Secure Boot Certificates, then Flag for certificates update. Alternatively, right-click and select Secure Boot Certificates > Flag for certificates update.

To unflag one or more VMs for certificate update at their next boot, use the following process:

  1. In the left panel, choose the VM or VMs that you wish to unflag for certificate update.

  2. From the main menu, select VM, then Secure Boot Certificates, then Unflag for certificates update. Alternatively, right-click and select Secure Boot Certificates > Unflag for certificates update.

Secure Boot Certificates