# Unable to Boot/Flash with Secure-Boot

**URL:** <https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066>\
**Category:** Product support\
**Tags:** support\
**Created:** [October 3, 2023, 4:19pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066 "2023-10-03T16:19:54Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![cmorones15](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cmorones15](https://forums.balena.io/u/cmorones15)\
**Post date:** [October 3, 2023, 4:19pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/1 "2023-10-03T16:19:54Z")

</div>

Hi, I’m unable to get secure boot to work via the instructions.

I’ve tried to add the:  
“installer”: {  
“secureboot”: true  
}

Line of code to the bottom of the config.json in the boot folder on my USB

I’ve also tried to imbed that line within the existing config.json block

Neither boot the OS, they just load to a black screen with a blinking “\_”  
I’m unable to interact with the device in this state, the solutions is to power down and try again.

I’ve enable secure boot in the bios and reset UEFI settings to default

1: Is there additional guidance on how to setup the config.json file  
2: Is there a list of supported hardware?  
3: When I add a device from the dashboard I select the Generic x86\_ device type using version 4.0.16+rev3…is this the proper selection? Also the fleet itself is mostly Intel NUC device type…will that have an impact?  
4: Does secure boot work with NUC device?

---

<div class="post-metadata">

**Author:** ![alexgg](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@alexgg](https://forums.balena.io/u/alexgg)\
**Post date:** [October 3, 2023, 6:15pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/2 "2023-10-03T18:15:26Z")

</div>

Hi Chris,

Currently secure boot is only supported in the `Generic x86_64 (GPT)` image, so please make sure to download that device type image. The latest version available is fine.

We have verified it works on all versions of Intel NUCs, but some of them might require some atypical configuration. Could you please let us know the NUC’s model so we can offer some guidance?

We have a list of tested hardware, but most x86\_64 hardware with a TPMv2 should be supported.

Could you please confirm that you are using the right image and the NUC’ model and we’ll take it from there?

---

<div class="post-metadata">

**Author:** ![cmorones15](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cmorones15](https://forums.balena.io/u/cmorones15)\
**Post date:** [October 3, 2023, 7:39pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/4 "2023-10-03T19:39:56Z")

</div>

Confirmed the image used was balena-cloud-CMoTest-generic-amd64-4.0.16+rev2-v14.12.2.img

I’m not sure where to find the TPMv2 setup in my bios but here is a snip of the bios main page if that is helpful.

 ![IMG_2164.jpg](https://global.discourse-cdn.com/balena/original/2X/1/146e23c5413c51aa68bddfe607ea5c098674aac1.jpeg)

Model Information:

 ![image.png](https://global.discourse-cdn.com/balena/original/2X/8/8d61378143a82cc18745cac70dd29ed938f5311f.png)

Thank you for the assistance.

-Chris

---

<div class="post-metadata">

**Author:** ![the-real-kenna](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/the-real-kenna/32/9598_2.png) [@the-real-kenna](https://forums.balena.io/u/the-real-kenna)\
**Post date:** [October 5, 2023, 12:01am UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/8 "2023-10-05T00:01:11Z")

</div>

@cmorones15,  
Would you be able to take a picture of the Security tab as well? Often secure boot options are configured from that tab, so we’d like to have a look there if possible.

---

<div class="post-metadata">

**Author:** ![cmorones15](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cmorones15](https://forums.balena.io/u/cmorones15)\
**Post date:** [October 6, 2023, 4:32pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/10 "2023-10-06T16:32:14Z")

</div>

Can you share what the config.json format should be?

Do you nest the secure line within the existing config file or just append to the bottom as its own separate lines?

Attached is a photo of the security settings tab. Thank you.

-Chris

 ![IMG_2173.jpg](https://global.discourse-cdn.com/balena/original/2X/1/1922c14c2aa8a0be00127b43e40fb576a88c6e4d.jpeg)

---

<div class="post-metadata">

**Author:** ![alexgg](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@alexgg](https://forums.balena.io/u/alexgg)\
**Post date:** [October 9, 2023, 5:50pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/11 "2023-10-09T17:50:04Z")

</div>

Hi, the `config.json` would be something like:

```auto
{
  "applicationId": 1979282,
  "deviceType": "generic-amd64",
  "userId": 133437,
  "appUpdatePollInterval": 60000,
  "listenPort": 48484,
  "vpnPort": 443,
  "apiEndpoint": "https://api.balena-cloud.com",
  "vpnEndpoint": "cloudlink.balena-cloud.com",
  "registryEndpoint": "registry2.balena-cloud.com",
  "deltaEndpoint": "https://delta.balena-cloud.com",
  "mixpanelToken": "<token>",
  "apiKey": "<token>",
  "logsEndpoint": "https://logs.balena-cloud.com",
  "installer": {
    "secureboot": true
  }
}

```

Basically, you download the configuration file from the dashboard, `Add Device > Download configuration file only`, append the `installer` section above and configure your image with the balenaCLI 'balena os configure]([balena CLI Documentation - Balena Documentation](https://docs.balena.io/reference/balena-cli/#os-configure-image)) subcommand. Of course you can also download the image, mount the boot partition and carefully modified the `config.json` there following the instructions in [here](https://docs.balena.io/learn/more/masterclasses/host-os-masterclass/#12-advanced-editing-configjson-by-hand).

As for the UEFI configuration, as explained in the [docs](https://github.com/balena-os/meta-balena/blob/master/docs/secure-boot.md#balenaos-secure-boot-and-disk-encryption):

```auto
Additionally, UEFI must be configured properly prior to provisioning - at this moment the only supported way of provisioning is to set secure boot into "Setup Mode". This removes all the installed keys and leaves the storage accessible for programming from userspace. The installer may reboot the device during provisioning to ensure the keys were successfully installed.

```

Looking at that security tab, I would think that the `Clear secure boot keys` should place your device in setup mode and allow the installer to install balenaOS with secure boot.

Could you please give the above a try?

---

<div class="post-metadata">

**Author:** ![cmorones15](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cmorones15](https://forums.balena.io/u/cmorones15)\
**Post date:** [October 10, 2023, 5:32pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/13 "2023-10-10T17:32:57Z")

</div>

Thank you for the clarification on the config file format.

I’m running into issues after using balena etcher. Previously I would create the bootable disk, be able to view its content from windows file explorer and then update the config.json from within the file explorer. Now when I create a Gereric GPT device, after burning the usb drive is no longer accessible via file explorer. This leaves me unable to make the configuration changes required for secure boot. Am I mixing up my steps or missing something else?

---

<div class="post-metadata">

**Author:** ![alexgg](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@alexgg](https://forums.balena.io/u/alexgg)\
**Post date:** [October 10, 2023, 5:50pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/14 "2023-10-10T17:50:49Z")

</div>

Hi, this points to something not being right on your previous attempts as in the `generic-amd64` images the boot partition is an EFI partition that as you say is not auto-mounted by windows.

Try to:

1. Locate Command Prompt in the Start menu, right-click it, and select “Run as Administrator.”
2. Type `mountvol P: /S` in the Administrator Command Prompt window. This makes it accessible as drive P: from that window.

And please let us know if that works.

---

<div class="post-metadata">

**Author:** ![cmorones15](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cmorones15](https://forums.balena.io/u/cmorones15)\
**Post date:** [October 10, 2023, 6:12pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/16 "2023-10-10T18:12:07Z")

</div>

That didnt seem to do anything.

---

<div class="post-metadata">

**Author:** ![mtoman](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/mtoman/32/3599_2.png) [@mtoman](https://forums.balena.io/u/mtoman)\
**Post date:** [October 11, 2023, 10:28am UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/17 "2023-10-11T10:28:47Z")

</div>

Hi,

I would like to take a step back and check whether the same device provisions fine without secure boot. Basically just download the image from the dashboard (preferrably development, as this would give you a password-less login prompt for potential debugging), and try to provision the device. This would help us understand whether the issue is with related to the device in general or secure boot/TPM in particular.

---

<div class="post-metadata">

**Author:** ![cmorones15](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cmorones15](https://forums.balena.io/u/cmorones15)\
**Post date:** [October 11, 2023, 2:10pm UTC](https://forums.balena.io/t/unable-to-boot-flash-with-secure-boot/369066/19 "2023-10-11T14:10:00Z")

</div>

Hi,

A general flash of the NUC works fine. I was able to get a generic GPT image loaded and running a day ago. My issue is with modifying the configuration file. I’m unable to do this with the Generic image. Once I’ve flashed the USB with the generic Image it becomes unavailable for modification.

-Chris