Microsoft Surface Hub 2 SmCamera - Manual (Page 159)

If you haven't used Surface UEFI Configurator before, you need to prepare a certificate.
This certificate ensures that after a device is enrolled in SEMM, you can modify UEFI
settings only by using packages that are created with the approved certificate.
How you get a certificate depends on the size or complexity of your organization:
Enterprise organizations typically maintain their own infrastructure to generate
certificates according to standard security practices.
Medium-sized businesses and others often choose to get certificates from partner
providers. This option is recommended for organizations that don't have as much
IT expertise or lack a dedicated IT security team.
Alternatively, you can generate a self-signed certificate by using a PowerShell
script. For more information, see the
Surface Enterprise Management Mode
certificate requirements . Or you can use PowerShell to create your own certificate.
For more information, see the Self-signed certificate documentation.
The SEMM package that Surface UEFI Configurator creates must be secured with a
certificate. The certificate verifies the signature of configuration files before UEFI settings
can be applied. For more information, see the
SEMM documentation.
1. On a separate PC, install the Surface UEFI Configurator tool that you downloaded
earlier.
2. Open Surface UEFI Configurator, and then select Start .
Prepare the SEMM certificate
Create a SEMM package