Mok management will not load on boot
I have the same issue on a Taichi X370 motherboard and 1050Ti GPU with the MOK management menus not being visible. I tried enrolling a key in a vm just to see how the menu layout looked.
With the above I could blindly enroll a new key in MOK management.
Related videos on Youtube
Perse95
Updated on September 18, 2022Comments
-
Perse95 over 1 year
To preface: I'm not looking to disable secure boot as I have a second hard drive with Windows 10 installed. The two OSes exist on two separate drives and are isolated from each other during runtime. Windows Boot Manager and GRUB exist on their own respective drives and are completely unaware of each other.
The relevant system configuration is:
- OS: Ubuntu 17.04 - Kernel: 4.10.0-32-generic
- Motherboard: Asrock Taichi X99
- GPU: GTX 1080
So, I've been trying to use mokutil to enroll my own certificate so I can use it to load signed Nvidia drivers, but I've run into troubles with getting the whole procedure to work.
So the steps I took were:
- Enable secure boot support in Ubuntu.
- Create an x509 certificate with openssl.
- Ran
mokutil --enable-validation
and entered a password. - Used
mokutil --import
to add the newly created certificate to the secure boot keys list. - Used the signing script under the efi directory to sign kernel modules using the private key and certificate pair I created.
- Rebooted the system.
- Selected the boot entry with
shimx64.efi
- Pressed key to enter mok management
- Got stuck on this screen:
-
Rod Smith over 6 yearsWhen you say you "got stuck," what happens when you press a key? Is the keypress ignored and the countdown continues? Does the system hang? Does the system reboot? Do you see an error message? Something else?
-
Perse95 over 6 years@RodSmith The countdown stops, effectively MOK Management opens, there just isn't any output to the display of the interface. Based on the screenshots of what should be there, pressing enter once continues boot. I managed to enroll a key by pressing keys and entering the password according to screenshots, but there is no visual display of anything.
-
Rod Smith over 6 yearsThis sounds like an EFI video driver problem. You mention an Nvidia GPU. Is this on a plug-in card, or built into the motherboard? If the former, you might try unplugging the card, just to enroll the key. If the latter, you could poke around in the firmware settings for relevant video options, and you might want to report it as a bug to the motherboard manufacturer.
-
Perse95 over 6 yearsIt's a plug-in card, but I have no integrated graphics nor another card that would also work to see if it's a motherboard or video card driver issue. I think I will report it tho, it seems like a very annoying bug.
-
Rod Smith over 6 yearsAh, I see. Be sure that the card provides EFI firmware, then. It could be that the card was designed for BIOS-based computers and is relying on the computer's CSM (BIOS compatibility layer), which might be flaking out a bit, particularly when you're trying to do something related to Secure Boot. Some manufacturers provide video card firmware updates to enable EFI compatibility, so you might look for that, too.
-
Perse95 over 6 yearsIt should as it is an EVGA card that is, from my research, uefi compliant. It might also be a fluke with the whole system composition, just the right combination of parts to mess things up. I'll see if Asrock support has anything to say, maybe they've encountered this before.
-
tiguchi over 4 yearsI ran into exactly the same problem. Same main board but an RTX 2080 GPU. You answer here is a life saver. However I kept on hitting into the following issue: my password was getting rejected. I kept on seeing
Invalid character
in the middle of a black screen. After a bit of research I found several forum posts of people speculating that the MOK management password cannot be longer than 4 characters, and must not contain digits. So I simply set it topass
. Retried again, and finally I got my key enrolled -
David over 2 yearsIf you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review
-
Sandor Semsey over 2 yearsThat's fine, but now I'm confused a bit. I don't have a question as I've found the solution (for my case). I decided to put a new answer, as the accepted answer is more like a workaround (which is great actually), but not a real solution. I still like to share this information, what would be the correct way for that?