I can fully sympathise with the difficulties you have had, I spent months trying to find a complete guide to installing VirtualBox on a UEFI system with Secure Boot enabled and I wanted to keep Secure Boot enabled and of the few guides out there, I couldn't get any to work and mostly all of them advised to disable Secure Boot and I didn't want to an in any case its not possible to Disable Secure Boot on my system (Acer) and I believe the ASUS is the same int that you cant disable Secure Boot and you shouldn't have to. I also had some UEFI processor bug, it reported it at startup? once I removed Windows and installed Ubuntu, curious I thought since I never had any UEFI bug while Windows was installed and why should I it is a brand new laptop, I put it down to Microsoft and the manufacturer, trying to put people off migrating away from Windows, this so called bug didn't have any bearing on my Ubuntu or VirtualBox installation and never prevented my registering the MOK keys. I mean following other instructions I was never presented with any MOK screens after a reboot and at first thought it was the so called bug but it wasn't. If I recall I reinstalled Windows and I updated my BIOS firmware and that was only to ensure I had the latest firmware as a precaution, before migrating to Ubuntu and I am sure the firmware update didn't make any difference and I kept seeing the UEFI bug on startup, but this so called bug has magically disappeared after Kernel updates.
The only difference for me is that I never use dual boot and the whole point of installing VirtualBox was that if I need to use Windows, I would have it installed in a guest virtual machine. When I installed I was using VirtualBox 6.0 and my kernel version 4.18.0-25-generic and since I have upgraded up to 5.0.0-36-generic and Ubuntu 18.04.3 and I have also since upgraded VirtualBox to version 6.0.14 and I have never had to resign the modules, or had any issues, I think at some point possibly from v6.0.10 onwards I am told you don't have to sign the modules manually but I found it useful to know anyway. Here is what I did:
Installing Oracle Virtualbox 6.0 on UEFI System with Secure Boot enabled
Instructons for 64 bit debian based linux distributions only, in this particular case I am using ubuntu 18.04.02 (bionic).
1. Install Virtualbox from the Oracle repositories
(The advantage of installing from Oracle repositories is that Virtualbox automatically updates along with system updates). Add the Oracle VirtualBox repository to your the list of repositories using this command:
sudo add-apt-repository "deb [arch=amd64] http://download.virtualbox.org/virtualbox/debian <dist> contrib"
replace <dist> in the above command with your distribution from the following:
bionic (18.04)
artful (17.10)
zesty (17.04)
yakkety (16.10
xenial (16.04)
wily (15.10)
vivid (15.04)
utopic (14.10)
So if your system is bionic (18.04) the command is:
sudo add-apt-repository "deb [arch=amd64] http://download.virtualbox.org/virtualbox/debian bionic contrib"
1.2 Download and register the OracleVirtualbox GPG keys by issuing the commands:
(GPG keys allow you to verify and communicate with the VirtualBox repository)
wget –q https://www.virtualbox.org/download/oracle_vbox_2016.asc -O- | sudo apt-key add -
wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | sudo apt-key add –
2. Signing the virtualbox modules and registering the MOK key
2.1. Create the public and private keys by first running the following command to create a directory (folder) in your home drive to store the keys:
mkdir ~/keys
2.2 Now run the following command to generate the public and private keys
openssl req -new -x509 -newkey rsa:2048 -keyout ~keys/MOK.priv -outform DER -out ~keys/MOK.der -nodes -days 36500 -subj "/CN=\Vbox"
NB: Mok keys using the above command are output to /keys/
run the command ls -al ~/keys/ to see the mok keys were generated successfully
2.3. Sign the virtualbox modules with the public and private keys
(uname -r substututes your linux kernel version e.g. 4.18.0-25-generic) so you don't have to find it and add it into the command manually
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ~/keys/MOK.priv ~/keys/MOK.der $(modinfo -n vboxdrv)
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ~/keys/MOK.priv ~/keys/MOK.der $(modinfo -n vboxnetflt)
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ~/keys/MOK.priv ~/keys/MOK.der $(modinfo -n vboxnetadp)
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ~/keys/MOK.priv ~/keys/MOK.der $(modinfo -n vboxpci)
2.4. Import the MOK’s (Machine Owner Keys) to Secure Boot.
(Note: The MOK Util will ask for a password)
sudo mokutil --import MOK.der
2.5. Reboot and follow instructions to Enroll MOK.
2.6. Confirm the MOK is enrolled. Type the following command in a terminal
$ cd ~/keys
$ mokutil --test-key MOK.der
MOK.der is already enrolled
