# Create a pkcs12 file from private key and certificate file.
host:~$ openssl pkcs12 -export -out foo_key.p12 \
        -inkey signing_key.pem -in xyz_cert.x509.pem

# Import pkcs12 file into pesign db
host:~$ pk12util -i foo_key.p12 -d /etc/pki/pesign

# Do the signing
host:~$ pesign -c my-signing-cert -s \
        -i foo.unsigned.efi -o foo.signed.efi

# Add the HSM PKCS-11 library to the NSS database
host:~$ modutil -dbdir /etc/pki/pesign -add vendor-engine \
        -libfile /usr/lib64/pkcs11/vendor-engine.so
WARNING: Performing this operation while the browser is running
could cause corruption of your security databases. If the browser
is currently running, you should exit browser before continuing
this operation. Type
'q <enter>' to abort, or <enter> to continue: <type enter here>

Module "vendor-engine" added to database.

# List the added module
host:~$ modutil -dbdir /etc/pki/pesign -list
-----------------------------------------------------------
  1. NSS Internal PKCS #11 Module
	   uri: pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.52
	 slots: 2 slots attached
	status: loaded

	 slot: NSS Internal Cryptographic Services
	token: NSS Generic Crypto Services
	  uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203

	 slot: NSS User Private Key and Certificate Services
	token: NSS Certificate DB
	  uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203

  2. opensc-pkcs11.so
	library name: /usr/lib64/pkcs11/opensc-pkcs11.so
	   uri: pkcs11:library-manufacturer=OpenSC%20Project;library-description=OpenSC%20smartcard%20framework;library-version=0.20
	 slots: 1 slot attached
	status: loaded

	 slot: Generic Smart Card Reader Interface [Smart Card Reader Interf...
	token: OpenSC Card (myorg-sb-signer)
	  uri: pkcs11:token=OpenSC%20Card%20(myorg-sb-signer);manufacturer=OpenSC%20Project;serial=56516a130f35;model=PKCS%2315
-----------------------------------------------------------

# List certs in tokens
host:~$ certutil -d /etc/pki/pesign \
        -h "OpenSC Card (myorg-sb-signer)" -L
Certificate Nickname                             Trust Attributes
                                                 SSL,S/MIME,JAR/XPI

Enter Password or Pin for "OpenSC Card (myorg-sb-signer)": <type the PIN here>
OpenSC Card (myorg-sb-signer):/CN=My Org's SB Signer    u,u,u

# Sign with private key in HSM
host:~$ pesign -t "OpenSC Card (myorg-sb-signer)" \
        -c "OpenSC Card (myorg-sb-signer):/CN=My Org's SB Signer" \
        -s -i foo.unsigned.efi -o foo.efi

# Initialize a SoftHSM token
host:~$ mkdir -p $HOME/.config/softhsm2/tokens
host:~$ echo "directories.tokendir = $HOME/.config/softhsm2/tokens" > $HOME/.config/softhsm2/softhsm2.conf
host:~$ softhsm2-util --init-token --label HSM --so-pin Secret.123 --pin Secret.123 --free

# Store this PIN in a file
host:~$ cat ~/pwfile.txt
Secret.123

# Generate a CA directly in this token
host:~$ efikeygen -t HSM -d /etc/pki/pesign -n example \
        --ca --self-sign --common-name "CN=example,OU=example,O=example" --kernel

# Confirm the certificate is really in there
host:~$ certutil -d /etc/pki/pesign -h HSM -L

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Enter Password or Pin for "HSM": <type the PIN 'Secret.123' here>
HSM:example                                                  u,u,u

# Do the signing
host:~$ pesign -t HSM -n /etc/pki/pesign -c example \
        -i ~/shimx64.efi.unsigned -o ~/shimx64.efi.signed \
        --pinfile ~/pwfile.txt -s

# Import the public certificate into the NSS Database
host:~$ certutil -d /etc/pki/pesign -A -n myorg-sb-signer \
        -t ,,u -i myorg-sb-signer.cer

# Export the PKCS-7 SignedAttributes section pesign generates
host:~$ pesign -i foo.unsigned.efi -E foo.sattrs.bin

# Generate a signature using OpenSSL
host:~$ openssl dgst -sha256 -sign $KEY \
        --keyform ENGINE --engine $ENGINEID \
        -out foo.sattrs.sig foo.sattrs.bin

# Import the signature with the original SignedAttributes into
# the PE binary
host:~$ pesign -c myorg-sb-signer \
        -R foo.sattrs.sig -I foo.sattrs.bin \
        -i foo.unsigned.efi -o foo.efi