Debugging iPXE + HTTPS

README.md

Debugging iPXE image Download over HTTPS

Build iPXE

Get the source:

git clone git://git.ipxe.org/ipxe.git

Install dependencies.

Enable HTTPS support:

cd ipxe/src
sed -i 's/#undef\tDOWNLOAD_PROTO_HTTPS/#define\tDOWNLOAD_PROTO_HTTPS/' config/general.h

Build an iPXE ISO image:

make bin/ipxe.iso

Boot iPXE using QEMU

qemu-system-x86_64 -m 1024 bin/ipxe.iso --curses

iPXE should boot. Hit Ctrl + B to get an interactive iPXE prompt:

SeaBIOS (version 1.12.0-20181126_142135-anatol)


iPXE (http://ipxe.org) 00:03.0 C980 PCI2.10 PnP PMM+3FF92370+3FEF2370 C980



Booting from Hard Disk...

ISOLINUX 6.04 6.04-pre1-41-g5e426532* EHDD Copyright (C) 1994-2015 H. Peter Anvin et al
iPXE ISO boot image
Loading ipxe.krn... ok
iPXE initialising devices...ok



iPXE 1.0.0+ (36a4c) -- Open Source Network Boot Firmware -- http://ipxe.org
Features: DNS HTTP HTTPS iSCSI TFTP SRP AoE ELF MBOOT PXE bzImage Menu PXEXT

iPXE>

Fetch a file over HTTPS

Obtain an IP address from DHCP:

iPXE> dhcp
Configuring (net0 52:54:00:12:34:56)...... ok
iPXE>

Fetch a file from a working source:

iPXE> imgfetch https://google.com
https://google.com.... ok
iPXE>

Fetch a file from a non-working source:

iPXE> imgfetch https://letsencrypt.org
https://letsencrypt.org... Permission denied (http://ipxe.org/022fe23c)
iPXE>

Just came across this while searching for something else, know it is old, but might as well leave some tips.
If you are on linux (or WSL2) you can actually run iPXE directly.
Simple example:

git clone --depth 1 git://git.ipxe.org/ipxe.git
make -C ipxe/src -j8 bin-x86_64-linux/slirp.linux DEBUG=tls && ipxe/src/bin-x86_64-linux/slirp.linux --net slirp

You have 2 places of Ctrl-B first is before automatic DHCP, and the second is after when it gets "Nothing to boot",
So if you wait for the second one it will have run dhcp for you.

HTTPS is now enabled by default (except for pcbios builds)