I am chainloading iPXE (undionly.kpxe) and using an embedded script wanting to boot from HTTPS.

The problem is the HTTPS server is connecting to the http server (a custom service) via stunnel using a self signed certificate created with:

openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem

When it tries to contact the server I get "Permission denied" errors. Yet the URL works correctly from a browser.

I've tried downloading http://ca.ipxe.org/ca.crt and recompiling undionly.kpxe with the TRUST=ca.crt option but this didn't work.

I'm not very familiar with certificate management. How do I get ipxe to trust the stunnel server?


1 Answer 1


You need to add your certificate to the CA used by ipxe.

Another solution would be to create a private CA (a root certificate that you will use to sign the host certificates), then configure ipxe to use this CA. See: http://ipxe.org/cfg/crosscert

The best solution is to sign your certificates by a public CA.

  • Thanks, yes I got it to work by using TRUST= from the stunnel.pem file. Which isn't terribly secure so I may try the cross signing option.
    – hookenz
    May 30, 2013 at 4:52
  • Is there a way to keep iPXE's root certificate when adding your own certificate to trust? Nov 21, 2019 at 8:43
  • Concatenate all of them. Nov 21, 2019 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .