Citrix Virtual Apps and Desktops

Secure boot

August 22, 2024

Contributed by:

C C

Secure boot is designed to ensure that only trusted software is used to boot the system. The firmware has a database of trusted certificates and verifies that the image it loads is signed by one of the trusted certificates. If that image loads further images, then that image must also be verified in the same way. vTPM is a virtualized software instance of a traditional physical TPM module. The vTPM enables attestation by measuring the entire boot chain of your VM (UEFI, OS, system, and drivers).

See the following for more information on supported cloud services:

Secure boot in Google Cloud Platform

You can provision shielded virtual machines on GCP. A shielded virtual machine is hardened using a set of security controls that provide verifiable integrity of your Compute Engine instances, using advanced platform security capabilities like secure boot, a virtual trusted platform module, UEFI firmware, and integrity monitoring.

For more information on using PowerShell to create a catalog with shielded VM, see Using PowerShell to create a catalog with shielded VM.

Note:

If you install Windows 11 on the master image, then you must enable vTPM during the master image creation process. Also, you must enable vTPM on the machine profile source (VM or instance template). For information on creating Windows 11 VMs on the sole-tenant node, see Create Windows 11 VMs on the sole-tenant node.

Secure boot in Microsoft Azure

In Azure environments, you can create machine catalogs enabled with Trusted launch. Azure offers trusted launch as a seamless way to improve the security of generation 2 VMs. Trusted launch protects against advanced and persistent attack techniques. At the root of trusted launch is secure boot for your VM. Trusted launch also uses the vTPM to perform remote attestation by the cloud. This is used for platform health checks and for making trust-based decisions. You can individually enable secure boot and vTPM. For more information on creating a machine catalog with Trusted launch, see Machine catalogs with Trusted launch.

Secure boot in VMware

MCS supports creating a machine catalog with vTPM attached VMware template as a source for machine profile input. If windows 11 is installed on the master image, then it is a requirement to have vTPM enabled for the master image. Therefore, the VMware template, which is a source of machine profile, must have vTPM attached to it. For more information, see Create a machine catalog using a machine profile.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Secure boot

August 22, 2024

Contributed by:

C C

August 22, 2024

Contributed by:

C C

Secure boot

Secure boot in Google Cloud Platform

Secure boot in Microsoft Azure

Secure boot in VMware

In this article