In ubuntu 20.04 LTS; I was compiling the latest kernel 5.11.11 after adding a new system call, during the execution of make command I got this error:

make[1]: *** No rule to make target 'debian/canonical-certs.pem', needed by 'certs/x509_certificate_list'.  Stop.
make: *** [Makefile:1809: certs] Error 2

If someone can help I would really appreciate it, Thank you.

  • 1
    Did you modify the value of CONFIG_SYSTEM_TRUSTED_KEYS in configuration?
    – Kulfy
    Apr 6 at 12:33

In your kernel configuration file you will find this line:


Change it to this:


Depending on your source structure you might be able to do it via command line. Examples:

scripts/config --disable SYSTEM_TRUSTED_KEYS


scripts/config --set-str SYSTEM_TRUSTED_KEYS ""
  • Thankyou so much Apr 6 at 16:13
  • you can edit it through the menuconfig by running "make menuconfig"
    – yehudahs
    Jun 8 at 13:42
  • Do you mind explaining a bit why you need to do this, like why do you think the canonical cert was in there to begin with and why it's ok to just remove it?
    – Shanteva
    Aug 5 at 12:46
  • @Shanteva : If one does not do it, then the kernel will not compile, as per the question. I assume it was added for additional kernel security. I do not know your requirements, so can not comment if it is ok to remove it for you or if you need to provide some other trusted key. For me, and I assume some others, it is fine to remove it. Note that it has been there for a long time, but Canonical just started using it. Aug 5 at 14:06
  • I mean why as in, .config explicitly says not to edit it, so why is that value set to begin with, and what would be the "proper" way of giving the build system what it wants with that value
    – Shanteva
    Aug 5 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.