// Module included in the following assemblies:
//
// * hardware_enablement/kmm-kernel-module-management.adoc

:_mod-docs-content-type: PROCEDURE
[id="kmm-adding-the-keys-for-secureboot_{context}"]
= Adding the keys for secureboot

[role="_abstract"]
To sign kernel modules with Kernel Module Management (KMM) on {product-title}, you can add Secure Boot certificate and private key files as Kubernetes secrets.

For details on how to create these, see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/managing_monitoring_and_updating_the_kernel/signing-a-kernel-and-modules-for-secure-boot_managing-monitoring-and-updating-the-kernel#generating-a-public-and-private-key-pair_signing-a-kernel-and-modules-for-secure-boot[Generating a public and private key pair].

For details on how to extract the public and private key pair, see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/managing_monitoring_and_updating_the_kernel/signing-a-kernel-and-modules-for-secure-boot_managing-monitoring-and-updating-the-kernel#signing-kernel-modules-with-the-private-key_signing-a-kernel-and-modules-for-secure-boot[Signing kernel modules with the private key]. Use steps 1 through 4 to extract the keys into files.

.Procedure

. Create the `sb_cert.cer` file that contains the certificate and the `sb_cert.priv` file that contains the private key:
+
[source,terminal]
----
$ openssl req -x509 -new -nodes -utf8 -sha256 -days 36500 -batch -config configuration_file.config -outform DER -out my_signing_key_pub.der -keyout my_signing_key.priv
----

. Add the files by using one of the following methods:
+
* Add the files as link:https://kubernetes.io/docs/concepts/configuration/secret/[secrets] directly:
+
[source,terminal]
----
$ oc create secret generic my-signing-key --from-file=key=<my_signing_key.priv>
----
+
[source,terminal]
----
$ oc create secret generic my-signing-key-pub --from-file=cert=<my_signing_key_pub.der>
----
+
* Add the files by base64 encoding them:
+
[source,terminal]
----
$ cat sb_cert.priv | base64 -w 0 > my_signing_key2.base64
----
+
[source,terminal]
----
$ cat sb_cert.cer | base64 -w 0 > my_signing_key_pub.base64
----

. Add the encoded text to a YAML file:
+
[source,yaml]
----
apiVersion: v1
kind: Secret
metadata:
  name: my-signing-key-pub
  namespace: default <1>
type: Opaque
data:
  cert: <base64_encoded_secureboot_public_key>

---
apiVersion: v1
kind: Secret
metadata:
  name: my-signing-key
  namespace: default <1>
type: Opaque
data:
  key: <base64_encoded_secureboot_private_key>
----
<1> `namespace` - Replace `default` with a valid namespace.

. Apply the YAML file:
+
[source,terminal]
----
$ oc apply -f <yaml_filename>
----
