# Secure Boot

> Report UEFI Secure Boot configuration on an Intel edge platform - enabled state, Setup Mode, and enrolled PK/KEK/db keys. Use when asked about Secure Boot status or boot chain key enrollment.

- Skill: `open-edge-platform/secure-boot` (Agent Skill)
- Install (CLI): `npx skillmds@latest add open-edge-platform/secure-boot`
- Raw SKILL.md: https://api.skillmd.com/api/skills/open-edge-platform/secure-boot/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: open-edge-platform (https://skillmd.com/u/open-edge-platform)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/open-edge-platform/secure-boot

---


# Secure Boot Configuration Skill

## Purpose

This skill reports the current UEFI Secure Boot configuration on the target system.

## What to Report

- Secure Boot status (Enabled/Disabled)
- Setup Mode status (Enabled/Disabled)
- Platform Key (PK) presence
- Key Exchange Keys (KEK) enrolled
- Signature database (db) entries

## Commands

### Check Secure Boot Status

```bash
# Check if Secure Boot is enabled
mokutil --sb-state

# Alternative: Check EFI variable directly.
# The first 4 bytes are the EFI attributes header, so skip them and read 1 data byte.
cat /sys/firmware/efi/efivars/SecureBoot-* 2>/dev/null | od -An -t u1 -j 4 -N 1 | tr -d ' '
```

**Interpreting Output:**
- `SecureBoot enabled` → Secure Boot is active
- Data byte value `1` → Enabled, `0` → Disabled

### Check Setup Mode

```bash
mokutil --sb-state | grep -i "setup mode"

# Alternative: Check EFI variable directly.
# The first 4 bytes are the EFI attributes header, so skip them and read 1 data byte.
cat /sys/firmware/efi/efivars/SetupMode-* 2>/dev/null | od -An -t u1 -j 4 -N 1 | tr -d ' '
```

**Interpreting Output:**
- Value `0` → Setup Mode disabled (normal operation)
- Value `1` → Setup Mode enabled (keys can be modified)

### Check Secure Boot Keys

```bash
# Platform Key (PK)
mokutil --pk

# Key Exchange Keys (KEK)
mokutil --kek

# Signature database (db)
mokutil --db

# List all enrolled keys
mokutil --list-enrolled
```

## Output Format

```
SECURE BOOT
  Status: Enabled/Disabled
  Setup Mode: Enabled/Disabled
  Platform Key (PK): Present/Not Found
  Key Exchange Keys (KEK): X enrolled
  Signature Database (db): X entries
```

## Dependencies

- `mokutil` package
- EFI boot mode (not legacy BIOS)
- Access to `/sys/firmware/efi/` filesystem