I upgraded my development edition Dell XPS 13 9360 (i.e. single-boot Ubuntu) from 17.10 to 18.04. During installation, I was asked whether I wanted to create a MOK key to install third-party drivers under secure boot. I said yes and specified a password. After restarting, I was met by the MOK management menu, with four options (iirc):

  1. continue boot
  2. change secure boot state
  3. enroll key from disk
  4. enroll hash from disk

I chose 3. However, it didn't accept my password, so all I could do was to proceed with 1.

The upgrade completed without issues, but in order to decide for myself whether this is a problem, I want to better understand the situation.

Specifically, I would like to know:

  1. Was enroll key from disk the correct option?
  2. Why was my password rejected? Could it be the MOK management menu uses a different keyboard layout from my standard layout in Ubuntu?
  3. Does this mean certain third-party drivers were not installed? How do I know which drivers, and how do I get a 'second chance', so to speak?
  4. mokutil --sb-state says SecureBoot is enabled, but I seem to get a message saying secure boot is disabled at least sometimes on startup. Perhaps only when I reboot? Is this significant?
  5. Do I even need third party drivers on this system? The only components that I feel could work better are the wifi, the touchpad (palm sensitivity when typing) and audio quality with plugged in earphones.
  • You can get a second chance. The manual way is to extract /var/lib/shim-signed/mok/MOK.der from the upgraded system, and copy it to either the EFI partition or a USB stick. Then start the MOK Manager again, enroll key from disk, and browse to MOK.der. You can also use update-secureboot-policy or mokutil with the appropriate flags to enroll/import keys. wiki.ubuntu.com/UEFI/SecureBoot/DKMS#Manual_method
    – Joel Purra
    Apr 18, 2019 at 15:02


You must log in to answer this question.

Browse other questions tagged .