Secure Boot
Secure Boot is a firmware feature that ensures a device only runs boot software that is cryptographically signed and trusted. SPEKTRA Edge OS supports Secure Boot so that the boot chain — from firmware through to the operating system — is verified before it runs.
Why use Secure Boot
Secure Boot protects against tampering with the boot path. Combined with disk encryption and device attestation, it raises the bar for an attacker with physical access: the device will refuse to boot modified or untrusted boot software.
What you need to do
On most generic x86 hardware, SPEKTRA Edge OS works with Secure Boot enabled using trust that is already present in the firmware, so you can simply leave Secure Boot enabled in the device’s firmware (UEFI) settings.
To enable or disable Secure Boot, enter the device’s firmware setup at boot and change the Secure Boot setting, as you would for any UEFI system. Refer to your hardware vendor’s documentation for how to reach firmware setup.
Locked-down firmware and certificate enrollment
Some hardware is locked down to trust only a specific set of signing certificates. In those environments you may need to enroll the SPEKTRA Edge signing certificate into the firmware’s trusted database so that the device will boot the OS.
If you operate such hardware, contact your SPEKTRA Edge representative for the signing certificate and enrollment guidance for your platform.
If a device will not boot with Secure Boot on
If a device fails to boot only when Secure Boot is enabled:
- Confirm the firmware is up to date.
- If the firmware requires explicitly trusted certificates, enroll the SPEKTRA Edge signing certificate (see above).
- As a diagnostic step, temporarily disable Secure Boot to confirm it is the cause, then re-enable it once trust is established.