@Tom-Elliott Just a thought, was reading through the docs and I noticed that because of the adhereance to stock iPXE 2.0 netbooting with HTTPS is disabled by default. This may be a little too complicated so I’d get avoiding this, but you could probably work around this by nesting shim and iPXE to boot a custom signed iPXE. It would work something like this:
Netboot iPXE 2.0 normally with it’s shim
Use autoexec.ipxe with the shim command to reload that shim
Using autoexec.ipxe chainload a custom build of iPXE 2.0 that has the FOG certificate bundled and trusted.
If the binary chained isn’t already trusted, I believe you should be able to use some scripting to then automatically chain in mokmanager or fallback to chaining via http.
Provided you use the normal FOG signing keys, this should work fine, though it does mean having two shims. It may be worth it to close that small gap in HTTPS. Both the shim and custom iPXE could be chain loaded via TFTP. It does add a little more complexity to the signing and boot process but I figured it was worth mentioning, as having HTTPS wherever possible does seem valuable.
