I have a dual-boot system and the following error appears after selecting any OS in the GRUB menu:

error: shim_lock protocol not found.
error: you need to load the kernel first.

Press any key to continue...

Pressing any key returned to GRUB, and so on.

After a short investigation, I found that shim is a software involved in the secure boot (SB) process, therefore, my first reaction was to disable SB in UEFI, which eliminated the error and allowed any OS to boot, so it could be seen as a "solution", however, disabling SB should not be necessary since Ubuntu comes ready to run with it, moreover, it is a layer of security that should not be ignored...

How to fix this error while keeping SB activated?

Question closed?

It is completely unacceptable that this question was closed even when someone stated that had this same problem in Ubuntu. This question needs to be reopened because there could be more solutions available to this problem.

  • 1
    Only Ubuntu and official flavors of Ubuntu are on-topic here, refer askubuntu.com/help/on-topic where you'll find other SE sites where you question will be welcome if you don't want to use a Linux Mint forum. (One advantage of Ubuntu is it's many support options, you opted for Linux Mint so take advantage of its support options, or SE Unix & Linux found in the on-topic link)
    – guiverc
    Commented Jun 20, 2023 at 3:45
  • If you update a Ubuntu system you'll get instructions on how the update is applied; just follow the prompts and these issues will not occur.
    – guiverc
    Commented Jun 20, 2023 at 3:49
  • I think this question belongs here since it could also be useful for Ubuntu users. Let me explain: I understand that Ubuntu and Linux Mint share the same package update method, and even share most of the essential repositories, this means that the Linux kernel update method is the same for both, and most probably the Linux kernel update is what caused the problem in my case (since it triggers a GRUB update), so it could also happen to an Ubuntu user. If it was a problem with, for example, some package built for Linux Mint (like Timeshift), I would agree with you.
    – Tedpac
    Commented Jun 20, 2023 at 4:32
  • In other words, in all the years I've been using Linux Mint, the vast majority of the problems I've had have been solved thanks to the questions I've found in this forum, because they are problems that come from Ubuntu.
    – Tedpac
    Commented Jun 20, 2023 at 4:39
  • Don't forget Linux Mint has an additional layer of software that Ubuntu does not include (the runtime adjustments that allow them to use foreign Ubuntu packages). Ubuntu upgrades make no allowance for them, which means some adjustments need tweaking after security patches flow through from Ubuntu - these are usually evident on screen; but you're off-topic asking about those here; as Ubuntu & flavors all have write access to Ubuntu repositories, thus they don't use adjustments. Updates can differ between Ubuntu & Linux Mint.
    – guiverc
    Commented Jun 20, 2023 at 4:39

2 Answers 2


I had the same problem installing Ubuntu 23.04 on an Acer Aspire E5-573G. To resolve, I entered the BIOS menu by repeatedly pressing F2 at startup, in the SECURITY tab I set the Supervisor Password to be able to access the other entries in the SECURITY tab. After setting the password I went to SELECT A UEFI FILE AS TRUSTED FOR EXECUTING and selected HDD0, EFI, UBUNTU, SHIMX64.EFI. As a name you can write Ubuntu or something else, it will be the name that will appear in Grub to start Ubuntu. Finally, from the BOOT tab, use the down arrow to go to EFI FILE BOOT 0: Ubuntu (or any other name you just gave) and press F6 to move it to the first position. Now save your BIOS changes and exit. On reboot, Grub should appear as usual.


Fortunately, the solution to this problem was very simple:

  1. Disable SB in UEFI to be able to start the OS (Linux Mint in my case).
  2. Install the shim-signed package: sudo apt install shim-signed
  3. Enable SB in UEFI.
  4. Verify that SB is enabled: mokutil --sb-state or dmesg | grep secureboot

Note 1: I guarantee this solution is not contaminated from other things I tried since I restored the full backup I made of my Linux Mint (read the question) before trying it.

Note 2: obviously, enabling or disabling SB in UEFI can be very different between motherboard manufacturers, so it won't be explained here.

Note 3: this is the source of the solution, but it should be noted that I did not try and do not intend to try everything that is there, since my SB is now working.

  • 1
    FYI: The package you mention here in step 2 is included by default on Ubuntu installs (refer releases.ubuntu.com/22.04.2/… etc)
    – guiverc
    Commented Jun 20, 2023 at 4:44
  • You're right, thanks for noticing it, but it's strange because at no recent time did I touch anything related to that package or GRUB. Anyway, I guess it's good to know that this error occurs because that package is missing.
    – Tedpac
    Commented Jun 20, 2023 at 4:52
  • 1
    I've experienced similar issue on Debian. It seems, even if shim-signed is present, it might need to be reconfigured in certain scenarios. For example, I've had to upgrade BIOS on my motherboard and all established EFI boot entries were dropped in the process, including shim-signed ones. sudo dpkg-reconfigure -f noninteractive shim-signed did the trick! Thank you!
    – TSB99X
    Commented Apr 21 at 16:19

Not the answer you're looking for? Browse other questions tagged .