Verify error:unable to get local issuer certificate

[sven-frotscher]

On my Ubuntu 18.04 install, running sudo bash BootHoleDetection.sh outputs:
PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:285:Verify error:unable to get local issuer certificate multiple times and warning: data remaining[...]: gaps between PE/COFF sections? under all but the first and last unable to get local issuer certificate.
The results are therefore inconclusive/contradictory.

Full log

$ sudo bash BootHoleDetection.sh
Boot Hole Detection Bash Script
Copyright (C) 2020, Eclypsium, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under certain conditions;

This system doesn't support Secure Boot
[+] SecureBoot is enabled

139817979026304:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:285:Verify error:unable to get local issuer certificate
140221731609472:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:285:Verify error:unable to get local issuer certificate
warning: data remaining[1171248 vs 1334816]: gaps between PE/COFF sections?
139892012039040:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:285:Verify error:unable to get local issuer certificate
warning: data remaining[1171248 vs 1334816]: gaps between PE/COFF sections?
140277558848384:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:285:Verify error:unable to get local issuer certificate
warning: data remaining[1114272 vs 1269496]: gaps between PE/COFF sections?
140381466229632:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:285:Verify error:unable to get local issuer certificate
warning: data remaining[1114272 vs 1269496]: gaps between PE/COFF sections?
140450651896704:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:285:Verify error:unable to get local issuer certificate
warning: data remaining[1059488 vs 1213032]: gaps between PE/COFF sections?
140181104057216:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:285:Verify error:unable to get local issuer certificate
warning: data remaining[1059488 vs 1213032]: gaps between PE/COFF sections?
140232442854272:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:285:Verify error:unable to get local issuer certificate

[-] sbverify failed to verify efi certificates: result inconclusive

Contents of /tmp/boothole_err

$ cat /tmp/boothole_err
No signature table present
Unable to read signature data from /boot/efi/EFI/GRUB/grubx64.efi

[Stas25519]

Hello, thank you for your interest and reporting those issues. The certificate verify error appears to be an issue with the sbsigntool package that we observed on one 18.04 test instance as well.

Fixing this would likely require using an alternative method for verifying the signature, as sbverify doesn't appear to be as reliable as we would like. One option may be to use osslsigncode extract-signature, and then manually verifying it with OpenSSL.

Additionally, mokutil reports that the system does not seem to support SecureBoot, which is not a condition we are currently checking for. This appears to be due to a missing SecureBoot EFI variable.

[sven-frotscher]

This system doesn't support Secure Boot and [+] SecureBoot is enabled come from mokutil and parts of the script and they disagree with each other, right?

[Stas25519]

Correct. The script currently assumes that secure boot is enabled unless mokutil reports it as disabled, since we did not take into account that some systems may not support secure boot at all.

We'll work on adding more explicit checks for this condition.