RPS Building iPXE ROMs

This guide shows how to configure an iPXE ROM with the specific options/features needed to be used within RPS.

Process Overview

The following steps are required to build a iPXE ROM that is trusted by the RPS root certificate:

  • Install prerequisites
  • Download iPXE source
  • Build ROM

Prerequisites

  • iPXE source
  • Admin Workstation
  • Linux workstation such as Ubuntu OR WSL (Windows Subsystem for Linux)
  • Linux packages
  • GCC
  • binutils
  • make
  • syslinux (required for building ISOs)
  • genisoimage (required for building ISOs)
  • liblzma

  • RPS public root certificate, Base64 encoded

    Note

    Most of the tools required to build an iPXE ROM are Linux based and can only be executed from Bash (Unix Shell). However, a Unix operating system is not required. The process in this document has been completed leveraging WSL (Windows Subsystem for Linux). WSL is available on a machine running 64-bit version of Windows 10 Anniversary Update build 14393 or later. If the development machine that the ROM is being built from does not have the required prerequisites an internet connection will be required to install them.

Installing the Tools in Bash

  1. Update the package list, sudo apt update
  2. Install GCC, sudo apt install gcc
  3. Install binutils, sudo apt install binutils
  4. Install make, sudo apt install make
  5. Install syslinux, sudo apt install syslinux
  6. Install genisoimage, sudo apt install genisoimage
  7. Install liblzma, sudo apt install liblzma-dev
  8. Install git, sudo apt install git

Download iPXE source and Build ROM that Trusts the RPS CA Root Certificate

  1. Navigate to the directory the source will be downloaded to and clone iPXE repository: git clone git://git.ipxe.org/ipxe.git
  2. After source is downloaded navigate to ipxe/src: cd ipxe/src

  3. To build a ROM that trusts the RPS root certificate run the following:

    make bin-x86_64-efi/ipxe.efi TRUST=<path to certificate> CERT=<path to certificate>

    b. Here is an example of building an iPXE, EFI compatible, ROM with the RPS certificate in the local folder.

    make bin-x86_64-efi/ipxe.efi TRUST=RPSbase64Ca.cer CERT=RPSbase64Ca.cer
    Note

    The ROM will be in the bin-x86_64-efi folder.

iPXE ROM Build Command Examples

All the examples are executed from the ipxe/src folder.

  1. Create an iPXE bootable ISO that trust the RPS root cert

    make bin/ipxe.iso TRUST=RPSbase64Ca.cer CERT=RPSbase64Ca.

  2. Create iPXE ROMs for all the compatible ESXi network adapters

    make bin/8086100f.mrom bin/808610d3.mrom bin/10222000.rom bin/15ad07b0.

certutil.exe -encode CaRootCert.cer base64Ca.cer
    Note

    Ensure the RPS root cert is Base64 encoded. If not run the following command from a Windows environment:

More Resources