diff --git a/test/py/tests/test_efi_capsule/SIGNER.crt b/test/py/tests/test_efi_capsule/SIGNER.crt
new file mode 100644
index 000000000000..f63ec01d9996
--- /dev/null
+++ b/test/py/tests/test_efi_capsule/SIGNER.crt
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDTCCAfWgAwIBAgIUD96z+lSbhDFN76YoIY2LnDBt1yQwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw
+NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMBuazX28i0y4L0loJYJOtlvF5eWb4tbx7zwei5c
+KoSzQYixinS10OrVy7y8mELyXOlGOOsM509vzvoia0nffwEPsvTBeS3le2JBz9iN
+/+AIo+gUmzgEPQN+jp+s4fi0yzRvq3BgWu1ego2gExxQ7AePQHoSkX8UeC3Kb7SF
+a8Kt/TopOupZfEuZ+EtoxPA4JUStFgEUEcRJEfpQqECXV+lKqcyqHc2ZUzMisu+i
+5omkneX8sEZdIPFsSGanCyY3F9VjWzIxo60PU2xUBOIcEUg5luR+VXT4090g/yCw
+8PSf9rIKgGIQSQKAlUSc7zuXQIdgIMTS1xUpc/Nx+SqWNZECAwEAAaNTMFEwHQYD
+VR0OBBYEFHndZVpPrAjc3OD3UZ3xkXQqDOlZMB8GA1UdIwQYMBaAFHndZVpPrAjc
+3OD3UZ3xkXQqDOlZMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AG88t6w0qTXE50ltps62f6wtuuZsiX1zj+AluO4E8E3Wi0QsNtT24JdY2P4mAg8y
+abYLdgJIldzzsfjWWok9Dfqnx29tqgesKWkgUo16v70i4EVZ9YWGe+CfOK639OxL
+4D0XPcU5CUpDrEcnt59wCxQ7IArZzrDxrqigEw5nReejtgQV/mEzvVOzWjLjmngy
+SpvrydxYpfSvOJ3KGV9xw3Oa/qO3pS0ZNX9QqZdcC94M0SI6OF635oxJkz6JToYq
++qtv9PZtZnEU/cwzL0nTXMj7yRsP5+2Wre26yT62nKRy9P/3UFwmsJ0OuEmnol5I
+141ZGfBYmSQ6EReOwNeK7A0=
+-----END CERTIFICATE-----
diff --git a/test/py/tests/test_efi_capsule/SIGNER.esl b/test/py/tests/test_efi_capsule/SIGNER.esl
new file mode 100644
index 0000000000000000000000000000000000000000..a54536e243d274b74985abbecfe234d14013ef33
GIT binary patch
diff --git a/test/py/tests/test_efi_capsule/SIGNER.key b/test/py/tests/test_efi_capsule/SIGNER.key
new file mode 100644
index 000000000000..9952647ed74a
--- /dev/null
+++ b/test/py/tests/test_efi_capsule/SIGNER.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQDAbms19vItMuC9
+JaCWCTrZbxeXlm+LW8e88HouXCqEs0GIsYp0tdDq1cu8vJhC8lzpRjjrDOdPb876
+ImtJ338BD7L0wXkt5XtiQc/Yjf/gCKPoFJs4BD0Dfo6frOH4tMs0b6twYFrtXoKN
+oBMcUOwHj0B6EpF/FHgtym+0hWvCrf06KTrqWXxLmfhLaMTwOCVErRYBFBHESRH6
+UKhAl1fpSqnMqh3NmVMzIrLvouaJpJ3l/LBGXSDxbEhmpwsmNxfVY1syMaOtD1Ns
+VATiHBFIOZbkflV0+NPdIP8gsPD0n/ayCoBiEEkCgJVEnO87l0CHYCDE0tcVKXPz
+cfkqljWRAgMBAAECggEAItLYrAdohC105kXs7bn14GtuRYx/2yRc3SBXvBQJzcHy
+1h3rBHvytszB9gHbPCJIFh8TJdZL9eAyAKpB6Dh9718773cjyt6AmaN3TaVE7PIj
+V1iDTnvV3tAEV3kd27g8Hd0nlUqaqeI0lhSl4LX0QNn3vR+nHOxDY2YDGRQcEDrD
+4hlCIGzAfbCW9gINdadQnC6p9NEBbfJ18doCagdn1Q1UYs8YlWwhBK98wXKGsG6T
+TUywOWIe6+VJqzSwZn5YkDVD3qD4tToar7T0jrCvZjbTbOsjtinD70c3uBcrK/XN
+gpwJfTiDLo1d0tNoWCRUH0myMs1fq3H3SkdfqB1GwQKBgQDrw8FwUc3Q+j8YhR7i
+73H/osk3VOZhCPsqbrQThUo5ZV4EXqp9E3PLN5E3suWgfaXVCEI3lHARUyR+J+E/
+evIrUUnkIryLdVOwwEWRonW4cLANjLSzT0eA85CFLXKUaij7Jfon2YNs9CmUARnC
+M96T3a89XOezX/SbRVz6X8KslQKBgQDQ8onkHcscHMANIjgxycIgYF+MvxwHRICA
+nt3ZSQiGSXJbWK7/sM5yd16ulvsXL7aF9G+q5osOzDWJ0w4SOhqNDfItrFH34Px6
+qEPjq/sAigqqrQls7uu7MHfkE+eEy181CoT9argxo8ifAQDn4YtXBW6L7p6AgaAx
+83FAbBcqDQKBgQClHk185534zTqhZqIyF7bEbfL0sJ5EuXCG0E+IGGLafdbxwocu
+4A/J9Jnc44sU8srQv1745Bn02EEHpdCIkAfJNL5Ga9mW5k39zTsr+xbtXObAJppr
+touCkZLW4vSLYypecsOXYyw7g2kXQgoTTBaHgsv3cvjHVN3QXSz4IVcLXQJ/LBL9
+AyFFtqhZ2mtdbyMfz7SEcyvcvau1b2wTX8IICktz09DhGQ4yffKwBiPS0xE9bwQg
+iewXaQeqQ2hBj5ayAw7uBrRSlfbfSwAzUdL1Hyf/GAFn+5JqJxISOAn6zAgaDRYq
+90mLkOz7ZI7RohfxTGnY56ttw62UHPU87lneiQKBgHcVituUDJgmbaHXx2IVzKsm
+5uDyXUf4S+tY5CZj6WTsb70+q4PYfh1D02nZgxuLNwpwNI0uhLIkLYHcL3poOapC
+LCXS8tsexNosmrTmjHFh/uNdKb7bKbMxyzYrr+ADKMclF3CJzKDzLfiIe9Na+bWa
+q5/HYNIw5zJyapPksgr4
+-----END PRIVATE KEY-----
diff --git a/test/py/tests/test_efi_capsule/SIGNER2.crt b/test/py/tests/test_efi_capsule/SIGNER2.crt
new file mode 100644
index 000000000000..8889a3ed930a
--- /dev/null
+++ b/test/py/tests/test_efi_capsule/SIGNER2.crt
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDTCCAfWgAwIBAgIUfmZcui7VkJEe9jx25Epo6jJ6l+owDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw
+NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBANozXTFKGVx0121MIBoSgxfI8IHcfY32T/LQusse
+PaXsm0GaJNwOgEP34u1k0cz466swfBCqTcZRjKuDpcH1sgrF1XaKjxuwYuiJrbsf
+ykVesN1z1bIamkFdVR/CBJEwN/epsyCBQCSbcxUwEX+ayq2zp+kSweew1B4i3u8f
+nbqFB15Rt+KAzFaBlvOJhmoZP7uYtb8zHa58eteaxQmPFt3v6eEbgOt92oVB8fPQ
+JJBuxUAHdimMDQ9mBGUosXR8PFyma5jOiOyY+0oTfig4bRHbGxCGMYyABJDH+j4e
+7Zl7lVMsq2fTm/lGONRX2QPLfMO298pz/wundJmYhseibvUCAwEAAaNTMFEwHQYD
+VR0OBBYEFDPYxE3oBmU1pWrZpY62JuXgcK5aMB8GA1UdIwQYMBaAFDPYxE3oBmU1
+pWrZpY62JuXgcK5aMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AEtY9QnvTvgmXmep7AMv/T6+GpERvsRdi+Lc+16L7uSCQhouDkeu5/sUHax6icX1
+NyDb3u6tyQhMnm7CD+7Mo74wrZ4vK2SzBoZSBLi+Tyz2ScyysdRIo7O42nxVyWm7
+ifZVfQKvanUjDSxPO89yJDYp0znvVpuZOzYXFHdprHoR5Atkth11HFHzWDzqblKS
+sx145wgPZ9bYohuOn1weyORsG9bJcHznPyJ1ceAOFk40bKWWLQtruWIhY4aZIlJN
+cDKv92rtgVApaamu+WRC4pzgQMQYKOcnMz4ZKeOKgEajfo6nOUVrvc0IYO6wixvi
+V+Msrg5o7ag2SN2AHg5/1/4=
+-----END CERTIFICATE-----
diff --git a/test/py/tests/test_efi_capsule/SIGNER2.key b/test/py/tests/test_efi_capsule/SIGNER2.key
new file mode 100644
index 000000000000..ee467fd9f7a6
--- /dev/null
+++ b/test/py/tests/test_efi_capsule/SIGNER2.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDaM10xShlcdNdt
+TCAaEoMXyPCB3H2N9k/y0LrLHj2l7JtBmiTcDoBD9+LtZNHM+OurMHwQqk3GUYyr
+g6XB9bIKxdV2io8bsGLoia27H8pFXrDdc9WyGppBXVUfwgSRMDf3qbMggUAkm3MV
+MBF/msqts6fpEsHnsNQeIt7vH526hQdeUbfigMxWgZbziYZqGT+7mLW/Mx2ufHrX
+msUJjxbd7+nhG4DrfdqFQfHz0CSQbsVAB3YpjA0PZgRlKLF0fDxcpmuYzojsmPtK
+E34oOG0R2xsQhjGMgASQx/o+Hu2Ze5VTLKtn05v5RjjUV9kDy3zDtvfKc/8Lp3SZ
+mIbHom71AgMBAAECggEBAJXskO3bAg364kJg+fWwHo7rLAWuYD54rXojXRVPFAC7
+z/mFVio1dIA/BJcknNr/db5MNBKnUYUgZ005yVy52rl4MTGgBrB5w5wPbWWTdEGx
+zEh83KnhiXe8D08g2k6AGRR8b224IUCF5s76FivdScGMHaURlFYDs9t5DkCzMocC
+ty0ewHv9aeMSzJl4y+DrRw+NkkAntlAkerCI5PInFtxyOQ6lFIRkMKlBA//VL0QF
+B9yGbmfoxlErWCqnj70DTcVO7O2AaijU+FTMRbb/V7r34GPU0Cfeum6gGNOtDkaX
+3UnWGR2esiHViMqz8vvEYtVIxHhLTD7INqDlK/yiNEECgYEA+ua1JcHXI2qS3cV/
+BuVvBrd3MzIpZvddCcTdo/B7WT3EoTupEG1gcajrCuNQDtRoizSbMuhCXYoMsktF
+wXFoTWoGr8yO7uVU5r2nCXZneprV3kuQmR0qYipN2GTCGSE1rKQI+YXeALPF1qIp
+12vUVdzWVDJvlQRMvSTlzpRZQkkCgYEA3qKI1ZsBszKPbnzLX91+ZAZeAwwN/HvS
+nrIveJAci/9U2yV2mw3l/Dulc8EkGABs/cMp47toje8DmsSfdu1yIYqpi3MHvefX
++ijc3ry5v28Hia3WP3WPczqhbkT7cco0t8Vwm9w1B+kkreuRCtyoCOLsRauB0CH1
+QJjMtPAth00CgYAKUUhruA/nxe8qLX/uwaqSJSNCuLJZKJzr1OukXTRFVDPsyW5H
+XagUpHSd6wEUywlNiClFq6VnAVFKV6wTq101qcGCoy/RhR67qlrfGb5hnVJkJMla
+coeWp9SxrFsK+4GgitJPqICbmMju7ZY45JdDvKQXrEdIYnfhY04L86/D+QKBgBxx
+nZPU0vnHCuYt0Xn0/XHgEmDHSH4qf7VAxKndl5gXTgsVlTqoIur/39qTIX5jh4lA
+RvjOd8Qydj5uwoTaP0ujwJeNYb7UgRZ35AgdCoo3sDnZ2NaQuXwaUIebDpjyIZwd
+AI8ZKjlRgxspToWZvWotO8yG5fXmcMQJAZZYXSi9AoGBALfXX/C5ojwms1l+XP+p
+FKzOFZ/uEKPfQid+2Sm1BknXXGVbs3zJ4OdonTvhjq+VQvXTW4IvjgY8TpumQZvE
+8nb7I8E1B6ajkSvgfetN9jlKM5hzIfJ3Vxx6hMGMab1ySKy3rZGPL706CW2BeMI2
+v2k9P0qWItuE4S7I4hEsovwS
+-----END PRIVATE KEY-----
diff --git a/test/py/tests/test_efi_capsule/capsule_defs.py b/test/py/tests/test_efi_capsule/capsule_defs.py
index 4fd6353c2040..aa9bf5eee3aa 100644
--- a/test/py/tests/test_efi_capsule/capsule_defs.py
+++ b/test/py/tests/test_efi_capsule/capsule_defs.py
@@ -3,3 +3,8 @@
 # Directories
 CAPSULE_DATA_DIR = '/EFI/CapsuleTestData'
 CAPSULE_INSTALL_DIR = '/EFI/UpdateCapsule'
+
+# v1.5.1 or earlier of efitools has a bug in sha256 calculation, and
+# you need build a newer version on your own.
+# The path must terminate with '/'.
+EFITOOLS_PATH = ''
diff --git a/test/py/tests/test_efi_capsule/conftest.py b/test/py/tests/test_efi_capsule/conftest.py
index 6ad5608cd71c..35cfa5513703 100644
--- a/test/py/tests/test_efi_capsule/conftest.py
+++ b/test/py/tests/test_efi_capsule/conftest.py
@@ -10,13 +10,13 @@ import pytest
 from capsule_defs import *
 
 #
-# Fixture for UEFI secure boot test
+# Fixture for UEFI capsule test
 #
 
-
 @pytest.fixture(scope='session')
 def efi_capsule_data(request, u_boot_config):
-    """Set up a file system to be used in UEFI capsule test.
+    """Set up a file system to be used in UEFI capsule and
+       authentication test.
 
     Args:
         request: Pytest request object.
@@ -40,6 +40,22 @@ def efi_capsule_data(request, u_boot_config):
         check_call('mkdir -p %s' % data_dir, shell=True)
         check_call('mkdir -p %s' % install_dir, shell=True)
 
+        capsule_auth_enabled = u_boot_config.buildconfig.get(
+                    'config_efi_capsule_authenticate')
+        # NOTE:
+        # private keys (SIGNER?.key) dn certificates (SIGNER?.crt)
+        # in this pytest directory are created this way:
+        # Create private key (SIGNER.key) and certificate (SIGNER.crt)
+        #    check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER.key -out SIGNER.crt -nodes -days 365'
+        #               % data_dir, shell=True)
+        #    check_call('cd %s; %scert-to-efi-sig-list SIGNER.crt SIGNER.esl'
+        #               % (data_dir, EFITOOLS_PATH), shell=True)
+
+        # Create *malicious* private key (SIGNER2.key) and certificate
+        # (SIGNER2.crt)
+        #    check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER2.key -out SIGNER2.crt -nodes -days 365'
+        #               % data_dir, shell=True)
+
         # Create capsule files
         # two regions: one for u-boot.bin and the other for u-boot.env
         check_call('cd %s; echo -n u-boot:Old > u-boot.bin.old; echo -n u-boot:New > u-boot.bin.new; echo -n u-boot-env:Old -> u-boot.env.old; echo -n u-boot-env:New > u-boot.env.new' % data_dir,
@@ -56,6 +72,19 @@ def efi_capsule_data(request, u_boot_config):
         check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 Test02' %
                    (data_dir, u_boot_config.build_dir),
                    shell=True)
+        if capsule_auth_enabled:
+            # copy keys/certificates
+            check_call('cp %s/test/py/tests/test_efi_capsule/SIGNER*.* %s' %
+                       (u_boot_config.source_dir, data_dir),
+                       shell=True)
+            # firmware signed with proper key
+            check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER.key --certificate SIGNER.crt Test03' %
+                       (data_dir, u_boot_config.build_dir),
+                       shell=True)
+            # firmware signed with *mal* key
+            check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER2.key --certificate SIGNER2.crt Test04' %
+                       (data_dir, u_boot_config.build_dir),
+                       shell=True)
 
         # Create a disk image with EFI system partition
         check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat %s %s' %
diff --git a/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py
new file mode 100644
index 000000000000..8fe93ef424ac
--- /dev/null
+++ b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py
@@ -0,0 +1,228 @@
+# SPDX-License-Identifier:      GPL-2.0+
+# Copyright (c) 2021, Linaro Limited
+# Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
+#
+# U-Boot UEFI: Firmware Update (Signed capsule) Test
+
+"""
+This test verifies capsule-on-disk firmware update
+with signed capsule files
+"""
+
+from subprocess import check_call, check_output, CalledProcessError
+import pytest
+from capsule_defs import *
+
+@pytest.mark.boardspec('sandbox')
+@pytest.mark.buildconfigspec('efi_capsule_firmware_raw')
+@pytest.mark.buildconfigspec('efi_capsule_authenticate')
+@pytest.mark.buildconfigspec('dfu')
+@pytest.mark.buildconfigspec('dfu_sf')
+@pytest.mark.buildconfigspec('cmd_efidebug')
+@pytest.mark.buildconfigspec('cmd_fat')
+@pytest.mark.buildconfigspec('cmd_memory')
+@pytest.mark.buildconfigspec('cmd_nvedit_efi')
+@pytest.mark.buildconfigspec('cmd_sf')
+@pytest.mark.slow
+class TestEfiCapsuleFirmwareSigned(object):
+    def test_efi_capsule_auth1(
+            self, u_boot_config, u_boot_console, efi_capsule_data):
+        """
+        Test Case 1 - Update U-Boot on SPI Flash, raw image format
+                      0x100000-0x150000: U-Boot binary (but dummy)
+
+                      If the capsule is properly signed, the authentication
+                      should pass and the firmware be updated.
+        """
+        disk_img = efi_capsule_data
+        with u_boot_console.log.section('Test Case 1-a, before reboot'):
+            output = u_boot_console.run_command_list([
+                'host bind 0 %s' % disk_img,
+                'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi',
+                'efidebug boot order 1',
+                'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
+                'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
+                'env save'])
+
+            # initialize content
+            output = u_boot_console.run_command_list([
+                'sf probe 0:0',
+                'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR,
+                'sf write 4000000 100000 10',
+                'sf read 5000000 100000 10',
+                'md.b 5000000 10'])
+            assert 'Old' in ''.join(output)
+
+            # place a capsule file
+            output = u_boot_console.run_command_list([
+                'fatload host 0:1 4000000 %s/Test03' % CAPSULE_DATA_DIR,
+                'fatwrite host 0:1 4000000 %s/Test03 $filesize' % CAPSULE_INSTALL_DIR,
+                'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
+            assert 'Test03' in ''.join(output)
+
+        # reboot
+        u_boot_console.restart_uboot()
+
+        capsule_early = u_boot_config.buildconfig.get(
+            'config_efi_capsule_on_disk_early')
+        with u_boot_console.log.section('Test Case 1-b, after reboot'):
+            if not capsule_early:
+                # make sure that dfu_alt_info exists even persistent variables
+                # are not available.
+                output = u_boot_console.run_command_list([
+                    'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
+                    'host bind 0 %s' % disk_img,
+                    'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
+                assert 'Test03' in ''.join(output)
+
+                # need to run uefi command to initiate capsule handling
+                output = u_boot_console.run_command(
+                    'env print -e Capsule0000')
+
+            output = u_boot_console.run_command_list([
+                'host bind 0 %s' % disk_img,
+                'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
+            assert 'Test03' not in ''.join(output)
+
+            output = u_boot_console.run_command_list([
+                'sf probe 0:0',
+                'sf read 4000000 100000 10',
+                'md.b 4000000 10'])
+            assert 'u-boot:New' in ''.join(output)
+
+    def test_efi_capsule_auth2(
+            self, u_boot_config, u_boot_console, efi_capsule_data):
+        """
+        Test Case 2 - Update U-Boot on SPI Flash, raw image format
+                      0x100000-0x150000: U-Boot binary (but dummy)
+
+                      If the capsule is signed but with an invalid key,
+                      the authentication should fail and the firmware
+                      not be updated.
+        """
+        disk_img = efi_capsule_data
+        with u_boot_console.log.section('Test Case 2-a, before reboot'):
+            output = u_boot_console.run_command_list([
+                'host bind 0 %s' % disk_img,
+                'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi',
+                'efidebug boot order 1',
+                'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
+                'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
+                'env save'])
+
+            # initialize content
+            output = u_boot_console.run_command_list([
+                'sf probe 0:0',
+                'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR,
+                'sf write 4000000 100000 10',
+                'sf read 5000000 100000 10',
+                'md.b 5000000 10'])
+            assert 'Old' in ''.join(output)
+
+            # place a capsule file
+            output = u_boot_console.run_command_list([
+                'fatload host 0:1 4000000 %s/Test04' % CAPSULE_DATA_DIR,
+                'fatwrite host 0:1 4000000 %s/Test04 $filesize' % CAPSULE_INSTALL_DIR,
+                'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
+            assert 'Test04' in ''.join(output)
+
+        # reboot
+        u_boot_console.restart_uboot()
+
+        capsule_early = u_boot_config.buildconfig.get(
+            'config_efi_capsule_on_disk_early')
+        with u_boot_console.log.section('Test Case 2-b, after reboot'):
+            if not capsule_early:
+                # make sure that dfu_alt_info exists even persistent variables
+                # are not available.
+                output = u_boot_console.run_command_list([
+                    'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
+                    'host bind 0 %s' % disk_img,
+                    'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
+                assert 'Test04' in ''.join(output)
+
+                # need to run uefi command to initiate capsule handling
+                output = u_boot_console.run_command(
+                    'env print -e Capsule0000')
+
+            # deleted any way
+            output = u_boot_console.run_command_list([
+                'host bind 0 %s' % disk_img,
+                'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
+            assert 'Test04' not in ''.join(output)
+
+            # TODO: check CapsuleStatus in CapsuleXXXX
+
+            output = u_boot_console.run_command_list([
+                'sf probe 0:0',
+                'sf read 4000000 100000 10',
+                'md.b 4000000 10'])
+            assert 'u-boot:Old' in ''.join(output)
+
+    def test_efi_capsule_auth3(
+            self, u_boot_config, u_boot_console, efi_capsule_data):
+        """
+        Test Case 3 - Update U-Boot on SPI Flash, raw image format
+                      0x100000-0x150000: U-Boot binary (but dummy)
+
+                      If the capsule is not signed, the authentication
+                      should fail and the firmware not be updated.
+        """
+        disk_img = efi_capsule_data
+        with u_boot_console.log.section('Test Case 3-a, before reboot'):
+            output = u_boot_console.run_command_list([
+                'host bind 0 %s' % disk_img,
+                'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi',
+                'efidebug boot order 1',
+                'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
+                'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
+                'env save'])
+
+            # initialize content
+            output = u_boot_console.run_command_list([
+                'sf probe 0:0',
+                'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR,
+                'sf write 4000000 100000 10',
+                'sf read 5000000 100000 10',
+                'md.b 5000000 10'])
+            assert 'Old' in ''.join(output)
+
+            # place a capsule file
+            output = u_boot_console.run_command_list([
+                'fatload host 0:1 4000000 %s/Test02' % CAPSULE_DATA_DIR,
+                'fatwrite host 0:1 4000000 %s/Test02 $filesize' % CAPSULE_INSTALL_DIR,
+                'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
+            assert 'Test02' in ''.join(output)
+
+        # reboot
+        u_boot_console.restart_uboot()
+
+        capsule_early = u_boot_config.buildconfig.get(
+            'config_efi_capsule_on_disk_early')
+        with u_boot_console.log.section('Test Case 3-b, after reboot'):
+            if not capsule_early:
+                # make sure that dfu_alt_info exists even persistent variables
+                # are not available.
+                output = u_boot_console.run_command_list([
+                    'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
+                    'host bind 0 %s' % disk_img,
+                    'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
+                assert 'Test02' in ''.join(output)
+
+                # need to run uefi command to initiate capsule handling
+                output = u_boot_console.run_command(
+                    'env print -e Capsule0000')
+
+            # deleted any way
+            output = u_boot_console.run_command_list([
+                'host bind 0 %s' % disk_img,
+                'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
+            assert 'Test02' not in ''.join(output)
+
+            # TODO: check CapsuleStatus in CapsuleXXXX
+
+            output = u_boot_console.run_command_list([
+                'sf probe 0:0',
+                'sf read 4000000 100000 10',
+                'md.b 4000000 10'])
+            assert 'u-boot:Old' in ''.join(output)
