I found this post: nvidia-smi command not found Ubuntu 16.04 | Ask Ubuntu

Which says that with IUEF secure boot enabled nvidia-smi could not found in ubuntu:

$ nvidia-smi
nvidia-smi: command not found

Any idea on how to enable secure boot with nvidai driver funcioning?

I found this article on solving the secure boot issue with virtual box, just still have little idea on how MOK manager works:

VirtualBox + Secure Boot + Ubuntu = fail | Øyvind Stegard blog

  • Why disabling “Secure Boot” is enforced policy when installing 3rd party modules askubuntu.com/questions/755238/… Do you need Secure Boot? Torvalds clarifies Linux's Windows 8 Secure Boot position zdnet.com/… the whole UEFI thing is more about control than security
    – oldfred
    Apr 8, 2018 at 14:18
  • Yes, kind of need secure boot. Do you think I can bypass this problem with MOK manager? I resolved secure boot issue with it on virtualbox problem
    – 2017561-1
    Apr 8, 2018 at 20:34
  • If anyone comes back to this after windows 11 upgrade, follow the next steps 1. Remove any currently installed nvidia drivers 2. Restart 3. sudo apt install nvidia-driver-XXX ( where XXX is the version. Currently it's 470 = nvidia-driver-470) 4. Set a password for the newly generated keys 5. Restart 6. Enable MOK 7. Type the password you previously set 8. Restart 9. Done
    – Mike
    Oct 6, 2021 at 6:24

4 Answers 4


Try this:

- Step 1: Download latest driver from NVIDIA website, https://www.geforce.com/drivers.

- Step 2: Create new pair private key (Nvidia.key) and public key (Nvidia.der) by entering command:

openssl req -new -x509 -newkey rsa:2048 -keyout PATH_TO_PRIVATE_KEY -outform DER -out PATH_TO_PUBLIC_KEY -nodes -days 36500 -subj "/CN=Graphics Drivers"


openssl req -new -x509 -newkey rsa:2048 -keyout /home/itpropmn07/Nvidia.key -outform DER -out /home/itpropmn07/Nvidia.der -nodes -days 36500 -subj "/CN=Graphics Drivers"

- Step 3: Enroll public key (nvidia.der) to MOK (Machine Owner Key) by entering command:

sudo mokutil --import PATH_TO_PUBLIC_KEY


sudo mokutil --import /home/itpropmn07/Nvidia.der

--> This command requires you create password for enrolling. Afterwards, reboot your computer, in the next boot, the system will ask you enroll, you enter your password (which you created in this step) to enroll it. Read more: https://sourceware.org/systemtap/wiki/SecureBoot

- Step 4: For the first time install NVidia driver, you need to disable Nouveau kernel driver by entering command:

echo options nouveau modeset=0 | sudo tee -a /etc/modprobe.d/nouveau-kms.conf; sudo update-initramfs -u

--> Reboot.

-Step 5: Install driver by entering command

sudo sh ./XXXXXX.run -s --module-signing-secret-key=PATH_TO_PRIVATE_KEY --module-signing-public-key=PATH_TO_PUBLIC_KEY


XXXXXX: name of file installer (download from NVIDIA).

PATH_TO_PRIVATE_KEY: full path to private key. If you place in home folder, use /home/USER_NAME/ instead of ~

PATH_TO_PUBLIC_KEY: full path to public key. If you place in home folder, use /home/USER_NAME/ instead of ~


sudo sh ./NVIDIA-Linux-x86_64-390.67.run -s --module-signing-secret-key=/home/itpropmn07/Nvidia.key --module-signing-public-key=/home/itpropmn07/Nvidia.der

--> Done

Read more https://us.download.nvidia.com/XFree86/Linux-x86/319.32/README/installdriver.html

  • 1
    Is there a way to do the same thing when installing driver packages through apt? I may be wrong but I prefer enabling the relevant repos/ppas and then apt upgrade'ing.
    – Karsus
    Jan 7, 2019 at 21:12
  • Is there an alternative to this for Windows?
    – Simon
    Mar 12, 2019 at 9:58
  • 1
    @Karsus Yes, look here blog.ubuntu.com/2017/08/11/how-to-sign-things-for-secure-boot. It's relatively straight forward. May 17, 2019 at 13:33
  • 1
    "This command requires you create password for enrolling. Afterwards, reboot your computer, in the next boot, the system will ask you enroll, you enter your password (which you created in this step) to enroll it." My computer does not ask for any enrollment after I reboot. What is wrong? I followed every step given by @itpropmn07. Aug 3, 2019 at 5:49
  • I just wanted to play games. Is there any easier way to do this?
    – Kshitij
    Jan 23, 2021 at 10:59

The recommendation from itpropmn07 works for me. There is one change I had to make which is the last step.

Instead of entering this command:

sudo sh ./XXXXXX.run -s --module-signing-secret-key=PATH_TO_PRIVATE_KEY --module-signing-public-key=PATH_TO_PUBLIC_KEY

I entered the command without -s:

sudo sh ./XXXXXX.run --module-signing-secret-key=PATH_TO_PRIVATE_KEY --module-signing-public-key=PATH_TO_PUBLIC_KEY

With this command I could interactively install the driver.

  • 2022 and I am getting --module-signing-secret-key=~/.mok/Nvidia_key. Any tips on this? I did remove the -s. May 30 at 18:19

I was also able to successfully install the drivers using the method by @itpropmn07 with one slight change.

The mokutil --import did not work on my ASUS motherboard so I had to import the key from inside the UEFI interface.

This can be done by loading the .der file onto a USB drive and navigating to the Secure Boot > Key Management section and selecting the Append Default db option.

A popup will then ask if you want to append the system default db. Make sure to select No, which will then let you browse to your file on the USB drive. Choose key certificate blob as the selected file type. Finally, save and exit.

You can verify that the import was successful by running: mokutil --db

Note: it would be wise to backup your secure boot keys and have them stored somewhere safe in case something goes wrong. Use the 'Save Secure Boot Keys' option for that. When restoring the keys, use UEFI secure variable as the file type.

Reference: http://www.rodsbooks.com/efi-bootloaders/controlling-sb.html#setuputil

  • I have a ASUS TUF laptop. I am not 100% through the process yet, but I was able to import it simply with mokutil --import. Maybe nowadays this importation might not be a problem anymore. May 30 at 18:17

I usually have this problem when I update my BIOS, secure boot gets switched off and the enrolled keys get deleted. What works for me is to boot into Ubuntu with secure boot on, rebuild my kernel modules, reboot again, enroll the key, and reboot into Ubuntu. See this answer for a oneliner.

Not the answer you're looking for? Browse other questions tagged or ask your own question.