[PATCH qemu-server v4 2/6] efi disk: clarify that there are multiple certificates

[Fiona Ebner <f.ebner@proxmox.com>]

Suggested-by: Daniel Kral <d.kral@proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

New in v4.

 src/PVE/CLI/qm.pm           |  3 ++-
 src/PVE/QemuServer.pm       | 11 ++++++-----
 src/PVE/QemuServer/Drive.pm |  4 ++--
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/PVE/CLI/qm.pm b/src/PVE/CLI/qm.pm
index 5326db5f..f1867337 100755
--- a/src/PVE/CLI/qm.pm
+++ b/src/PVE/CLI/qm.pm
@@ -700,7 +700,8 @@ __PACKAGE__->register_method({
     method => 'POST',
     description =>
         "Enroll important updated certificates to the EFI disk with pre-enrolled-keys. Currently,"
-        . " this is only the Microsoft UEFI CA 2023. Must be called while the VM is shut down.",
+        . " these are UEFI 2023 certificates from Microsoft. Must be called while the VM is shut"
+        . " down.",
     parameters => {
         additionalProperties => 0,
         properties => {
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 03354e31..d103731c 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -5406,11 +5406,12 @@ my sub check_efi_vars {
     my $efidisk = parse_drive('efidisk0', $conf->{efidisk0});
     if (PVE::QemuServer::OVMF::should_enroll_ms_2023_cert($efidisk)) {
         # TODO: make the first print a log_warn with PVE 9.2 to make it more noticeable!
-        print "EFI disk without 'ms-cert=2023w' option, suggesting that the Microsoft UEFI 2023\n";
-        print "certificate is not enrolled yet. The UEFI 2011 certificate expires in June 2026!\n";
-        print "The new certificate is required for secure boot update for Windows and common\n";
-        print "Linux distributions. Use 'Disk Action > Enroll Updated Certificates' in the UI\n";
-        print "or, while the VM is shut down, run 'qm enroll-efi-keys $vmid' to enroll it.\n\n";
+        print "EFI disk without 'ms-cert=2023w' option, suggesting that not all UEFI 2023\n";
+        print "certificates from Microsoft are enrolled yet. The UEFI 2011 certificates expire\n";
+        print "in June 2026! The new certificate are required for secure boot update for Windows\n";
+        print "and common Linux distributions. Use 'Disk Action > Enroll Updated Certificates'\n";
+        print "in the UI or, while the VM is shut down, run 'qm enroll-efi-keys $vmid' to enroll\n";
+        print "the new certificates.\n\n";
         print "For Windows with BitLocker, run the following command inside Powershell:\n";
         print "  manage-bde -protectors -disable <drive>\n";
         print "for each drive with BitLocker (for example, <drive> could be 'C:').\n";
diff --git a/src/PVE/QemuServer/Drive.pm b/src/PVE/QemuServer/Drive.pm
index ae907b5c..fa70ee6b 100644
--- a/src/PVE/QemuServer/Drive.pm
+++ b/src/PVE/QemuServer/Drive.pm
@@ -525,8 +525,8 @@ my %efitype_fmt = (
         type => 'string',
         enum => [qw(2011 2023 2023w)],
         description =>
-            "Informational marker indicating the version of the latest Microsoft UEFI certificate"
-            . " that has been enrolled by Proxmox VE. The value '2023w' means that both the"
+            "Informational marker indicating the version of the latest Microsoft UEFI certificates"
+            . " that have been enrolled by Proxmox VE. The value '2023w' means that both the"
             . " 'Microsoft UEFI CA 2023' and the 'Windows UEFI CA 2023' certificates are included."
             . " The value '2023' is deprecated and for compatibility only.",
         optional => 1,
-- 
2.47.3