We (the company I work for) run a FOG Server which we’ve used for the last year or so on 1.5, managing roughly 100 laptops/desktops.
We have a root CA which we use for all internal systems and so the certificate is pushed out via GPO to be installed in the Trusted Root Certification Store.
We also have custom Secure Boot keys to ensure we can boot the devices via network without having to disable Secure Boot.

When installing 1.5, we had the web server set up to use a certificate that we generated for FOG and manually signed the efi images with our Secure Boot keys.

Moving over to 1.6, we want to clean this up and let FOG handle all the signing on our behalf, so decided it would be best to start afresh.
Seeing as we’re going to be installing the fog agent (which removes the old fog client), server pinning wont be an issue, so long as it can use the same Secure Boot DB certificate for signing and server a web server certificate that ends in our internal CA.

We generated a new intermediate CA certificate for FOG signed by our trusted Root CA, spun up a new VM and installed a fresh copy of FOG 1.6 with the following commands

installfog.sh --install-mode embed-ca --https-redirect --web-ca-cert interca.crt --web-ca-key interca.key --web-ca-root ca.pem --internal-domain fogserver.local --secure-boot-key DB.key --secure-boot-cert DB.cert

This looks like it worked and our web interface was indeed signed by a certificate that ends in our Root CA.
Checking the Secure Boot images with sbverify also confirms that the efi files are signed correctly too.

$ sbverify --cert DB.crt /tftpboot/secureboot/ipxe-shimx64.efi
warning: data remaining[920352 vs 1048424]: gaps between PE/COFF sections?
Signature verification OK

However with this setup, ipxe refuses to load boot.php because aparently it is not built with my CA? See Github issue

This issue and its resulting fix seems to recommend pointing towards snponly.efi, which also seems to be signed correctly and boots fine.

$ sbverify --cert /home/administrator/fogcerts/DB.crt ipxe.efi
Signature verification OK

Great! lets move onto enrolling Secure Boot keys!

First we put a device in setup mode, booted FOG and choose to “Enroll Secure Boot Key (Unattended)”, but we get an error message stating that “Automatic Secure Boot enrollment failed”

Looking into the UEFI interface, the system is now in custom mode rather than setup, so it seems that the keys are indeed enrolled. Running the enrolment again says that the certificate is already trusted, so it looks like it has indeed worked after all.

To be on the safe side, we decided to try “Enroll Secure Boot Key (MOK attended setup)”. We get the blue screen, choose to install MOK.der and then reboot, but we don’t get the screen to confirm a pin code to finish enrolling the keys into MOK.

We’ve basically answered our own question about whether the keys are actually getting enrolled into the DB, it’s the messages we’re getting which are throwing us off. The Enrolment says it has failed, why is this?

We want to make sure we have all the answers and to ensure there isn’t going to be issues further down the line if we continue with the setup we currently have.