MokManager does not start on reboot

Question

I am on Ubuntu 18.04, 4.15.0-23-generic.

My laptop has two hard drives, one with windows 10, encrypted with bitlocker, and the other with Ubuntu, with LUKS full disk encryption.

Right now, when switching between the two OSes, I have to enter the bios to toggle secure boot on and off. I would ideally like to use secure boot on Ubuntu as well, but I am a virtual-box user, which means I have to sign the kernel modules.

I tried following these two guides: https://blog.ubuntu.com/2017/08/11/how-to-sign-things-for-secure-boot https://stegard.net/2016/10/virtualbox-secure-boot-ubuntu-fail/

I tried both independently, so I made to MOK.der certificates, and then ran mokutil --import MOK.der followed by immediate reboot.

I tried this several times, once after running sudo mokutil --enable-validation, every time the MokManager is not present at boot. Grub just runs normally, there is nothing in advanced options for starting ubuntu either, just the usual different kernel versions.

Any idea why MokManager just does not start at boot? I mentioned my enryption setup because I am wondering if that is the issue.

Solution

Firts, your platform must be in Secure Boot User Mode.

Do:

sudo mokutil --test-key MOK.der    
# your cert should not be currently enrolled

sudo mokutil --import <your cert>
# mokutil should request pwd 

sudo mokutil --test-key MOK.der    
# your cert should be enrolled now 

sudo mokutil --list-new    
# your cert should be displayed

reboot

MokManager should kick in and ask you to confirm cert enrollment.

Comments

[Mike Dacre]

OK, so this doesn't actually answer my question, because this is what I did and nothing happened, however three days after I had given up on a random reboot (after more than 6 other reboots), the MokManager just opened. No idea why or what was different, but I followed the instructions and it worked, so I am happy. That also means this is the correct answer. For anyone else finding this: it will work, eventually.