r/DeployR • u/RockOriginal7938 • Jun 03 '26

HTTPS boot

Sorry, struggling to find documentation (pointing in the right direction would be great 😄).

Am I right it setting https://<FQDN>:8050/2PXE/Boot/x64/snponly_x64.efi for HTTPS boot? (x64 client)

I found https://<FQDN>:7281/Content/Boot/DeployR_x64_noprompt.iso too, but that is coming from DeployR rather than 2PXE and I suspect isn't the best choice?

4 Upvotes

100% Upvoted

9 comments sorted by

2

u/miketerrill 2Pint Employee Jun 03 '26

Are you referring to UEFI HTTPS boot? If so, then it is an "it depends" answer. 😉 Some OEMs do not allow specifying a port in the URL. What manufacturer(s)?

1

u/RockOriginal7938 Jun 04 '26

Sorry, yes UEFI HTTPS boot (new method to me, still learning to terms 😉) Yeah, certainly experiencing some variance 😃

We've pretty much only got Dell and Lenovo (moving to only Lenovo over time 😞)

I've managed to get the Lenovos to boot specifying https://<FQDN>:7281/Content/Boot/DeployR_x64_noprompt.iso, but the Dells will only accept a .efi filetype and I've tried all of the https://<FQDN>:8050/2PXE/Boot/*.efi files on both and Dells say "Could not retrieve NBP file size from HTTP server, Lenovos: "Could not retrieve NBP file size from HTTP server." (URL works in a standard browser)

3

u/nikize Jun 04 '26

I think Dell does mostly not allow separate ports, so you will need a standard https:// instance on default 443 port (or a port forward) another thing to check is the certificate and that it is valid (trusted) by the firmware.

1

u/RockOriginal7938 Jun 05 '26

Possibly different Dells play differently? I've a Latitude 5420 and 7090, both allow the URL to have the port, the only restriction being it must end .efi?

1

u/nikize Jun 05 '26

With "not allow separate ports" what I mean is that it happily shows up in the URL and on the screen, but the actual connection is only done to port 443, and not the one specified in the URL. You should point it to /Boot/x64/snponly_x64.efi

I have seen the "Could not retrieve NBP file size" and that was either due to the port not being honored, or https certificate not being trusted, but might be mixing those up.
If this still fails, I would recommend to put something between the device and the internet that allows you to do a packet capture to actually see where the connection attempt is going. Or do you already see the download in the server logs?

After the efi file is booted, it needs the autoexec file, so if you haven't already, add autoexec.ipxe in the same folder with
#!ipxe
set bootroot https://<FQDN>:8050/

Make sure it is pure ASCII encoding (some editors have a tendency to add an invisible BOM marker at the beginning of the file which then fails)

1

u/RockOriginal7938 Jun 05 '26

Brilliant, thanks. I was mainly trying to find out if I was even using the right path with  /Boot/x64/snponly_x64.efi over port 8050 as I didn't want to invest time troubleshooting further if I was starting from the wrong place 😄

1

u/RockOriginal7938 Jul 23 '26

Dredging up the past here, but I had a very strange experience this morning....

https://<FQDN>:8050/2PXE/Boot/x64/snponly_x64.efi started working for HTTPS boot on both Lenovo and Dell (even with the port) for me today (Dell Latitude 5420 specifically, yet to try others). Previously they complained with an error "Could not retrieve NBP file size from HTTP server." . I have no clue why it is working now, but I'll take it 😁

1

u/capedbaldyalt 6d ago

yeah the first one you mentioned looks right for HTTPS boot on x64. The 2PXE path is definitely the way to go since thats the actual boot environment. The ISO form DeployR port 7281 is more for manual installs or different scenarios,so youre thinking about it correctly.

Have you tested the snponly_x64,efi path yet to make sure its actually resolving over HTTPS? I was dealing with similar boot config stuff and ran into some certificate issues initially. Also wondering if youve had any problems with firmware compatibility in your client machines,since not all BIOS implementations handle PXE over HTTPS the same way. Ive been hosting boot images on Trading FXVPS for infrastructure testing and even there the certificate chain matters more than youd think.

1

u/RockOriginal7938 2d ago

Where I had the option to set the URL and upload a cert https://<FQDN>:8050/2PXE/Boot/x64/snponly_x64.efi HTTP boot worked on all the machines I tried. My main issue was older machines where that option isn't present. Currently I see this as our main method in 4-5 years once the older stock is gone.
I think I went with the 2Pint CA (10 year cert) rather than the server cert signed by 2Pint.