I've installed Ubuntu several times in computers without UEFI thus without Secure Boot, but this time I am confused. I install Ubuntu 20.04 LTS in HP Envy 15, dual-boot with the existing Wind***. I've read several QA and explanation about MOK, but I'm still not sure. Let me tell the story. I appreciate your patience reading my story.

In this step, there were choices to install third-party software, I checked it and was asked to enter a password, twice of course. I entered a password. It said that I will be assisted to setup later.

Question 1: What password is this actually? Is it BIOS password, or password used to sign the grub, or simply a confirmation password I need to enter later after reboot?

Question 2: Is this a one-time password, or can I change this password later? How to change it?

After the installation process finished, I restarted the computer. And then, a blue screen appeared, something like MOK Management. There were four options: continue boot, enroll key, enroll key from disk, and enroll key from hash.

Question 3: Is this bluescreen part of firmware, or part of Grub?

Question 4: What is "key" actually? Was it the password I entered before?

Not sure what to choose, I chose option number 2, "enroll key". I expected an input prompt for a password, but it was not. Instead, there were two options, one of them was "view" something.

Question 5: Was the enrollment done automatically? Without entering anything such as a password or key?

I was confused then, while looking for an enlightenment on the internet, the computer screen turned off itself, I thought it was such an auto-sleep or auto-restart because I didn't do anything. After resumed/restarted, it was MOK Management again, but then, the second option was "reset" MOK list or something, instead of "enroll key". I chose "reset", I entered the password, and an error message appeared, something like no data or no something. After that, I chose "continue boot", and I entered Ubuntu desktop successfully. However, there was no assistance to install third party software like the installation wizard said. By the way, the auto-sleep or auto-restart happened several times because I continued searching on the internet although nothing really helped.

Question 6: How to verify that everything is okay (UEFI or Secure Boot is not messed with something password or key, third-party software is installed/activated successfully)?

Question 7: In MOK Management menu, what are enroll key, enroll from disk, and enroll from hash?

Thank you. Please guide me if asking too many question is prohibited in askubuntu.

Bonus: if someone is looking for Ubuntu compatibility with HP Envy 15: overall it is compatible, except:

  1. Mute-microphone key (on the keyboard) is not working
  2. Fingerprint scanner is not working (not recognized)
  3. Boot up is too long until GRUB appears
  4. Screen brightness is not saved (always reset to 100% every boot)
  • @Nmath Yes, the question is too many, but it's limited to "Secure Boot in Ubuntu installation steps". I've done my research so that I understand a little about MOK, Secure Boot, why it's there, etc. But I couldn't find Ubuntu installation guide that explains steps regarding SB and 3rd party. This is a real life problem; I am confused and not sure if I'd messed or succeeded with SB and 3rd party software. Thank you for your comment.
    – fikr4n
    Jun 4 at 4:08
  • I could ask "Please help me installing Ubuntu with Secure Boot and 3rd party software in HP Envy 15, and explain SB and MOK please" but it's too broad, so I made 7 points, to make the question clear. I'm sorry if it's still too broad.
    – fikr4n
    Jun 4 at 4:17

I agree this MOK management could have been explained better by the Ubiquity installer, as I have struggled with it myself.

Q1: This is the password to confirm enrolling the MOK key for your third-party drivers or software. You will only have to use this password once, so you can choose an easy one, as long as it's at least 8 characters long.

Q2: See above. You will only use it once, so no need to change it.

Q3: It's a part of Shim, Linux bootloader for UEFI systems. It boots GRUB, that then boots GNU/Linux.

Q4: No, the key is a long combinations of characters that's connected to the third-party drivers you're installing. Ubuntu also has this key, in fact, but it is signed by Microsoft themselves, so you need not manually enroll it. But any third-party drivers (like nVIDIA video drivers etc) need to be signed manually, which is what the Ubiquity installer does when prompting you to create a password for the new key. You need this password to confirm to the MOK management tool that it is really you who wants to enroll this key and not a malicious program or a hacker.

Q5: If you haven't entered your password, then the enrollment hasn't been done. I think you should have chosen the other option beside 'view', but then the screen is set to expire after several seconds of inactivity, which is what happened.

Q6: You can confirm that the key wasn't installed properly by opening up a terminal (Ctrl+Alt+T) and typing:

mokutil -l

This will list all the enrolled keys, which in your case should be none.

Now, as for whether you really need to enroll this key, this depends on what exactly the 'third-party-software' was. This could have been some hardware drivers, in which case your PC might not work as well as it could have and you should install these drivers and then enroll the key associated with them. Does your Hp Envy have an nVidia GPU? If so, the proprietary driver for this videocard was definitely among the third-party software you failed to install by not enrolling the MOK key successfully. You can remedy this by pressing the Super (Windows) key and typing Additional Drivers, then selecting the application Additional Drivers, choosing 'proprietary-tested' from the list there and installing it. This will prompt you to enroll the MOK key again, and this time you can finish it.

Hope this helps.

  • Thank you for your fast answer, I'll try this after work. I had many questions, but I limited it to 6. But now, since you responded it so fast, I think it's okay to add the 7th question (I just added it) :).
    – fikr4n
    Jun 4 at 4:05
  • Running mokutil -l outputs 2 keys. Additional Drivers shows "using x.org x server" is checked. After changing it to the first option (nvidia driver metapackage), and doing the password rituals, and reboot, and enroll, there are now 3 keys. Hm.. not sure if the first 2 keys were there before installing ubuntu, or ubuntu added them (?), one of them is canonical's, another one seems a test (testing cert for shim).
    – fikr4n
    Jun 4 at 14:09
  • Interesting! It's different on my system. I only have the one MOK for my nVidia GPU. Nonetheless, I'm glad it worked out. As for your Q7, I don't know what these options are for exactly. I would guess enroll from disk would search for a MOK key file on your hard drive or external storage. As for enroll from hash, you can check this article out: en.wikipedia.org/wiki/Hash_function Jun 5 at 4:41
  • 1
    By the way, I was wrong when I claimed that MOK was a part of UEFI. It's actually a part of Shim, the earliest Linux bootloader in UEFI systems. You can read more here: wiki.debian.org/SecureBoot Jun 22 at 13:59
  • 1
    Thanks, you can update your answer in case others read it but skip the comment section.
    – fikr4n
    Jun 23 at 4:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.