5

Every single information I run across says that in order to dual boot, I need to disable secure boot. This is confusing because according to this article, Ubuntu should work with secure boot. This wasn't the case for me. I had to disable it just to get grub showing.

At one point in time yesterday and today I decided to experiment with bcdedit to see if I could get Windows boot manager to handle the dual boot process instead and keep secure boot intact. That was a no go either.

So it it possible to dual boot Linux and Windows 10 with secure boot enabled?

2
  • 1
    The second answer (askubuntu.com/a/235618/158442) might be why. – muru Feb 6 '17 at 0:57
  • Well, disabling secure boot may still be necessary to boot Windows through grub (bug #1091464). – ubfan1 Feb 6 '17 at 4:11
5

Yes, it should be possible to boot both Linux and Windows 10 with secure boot enabled. However, this will be dependent on your machine's firmware and configuration.

You'll need to ensure that the signing key for both of the operating systems is present in the UEFI key database (specifically, the db key database).

The Ubuntu shim binary (the first thing loaded by your machine's firmware) is signed with the following key chain:

image signature issuers:
 - /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
image signature certificates:
 - subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=MOPR/CN=Microsoft Windows UEFI Driver Publisher
   issuer:  /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
 - subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
   issuer:  /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation Third Party Marketplace Root

- so you'll need to ensure that at least one of those is present in db.

Then, the shim will load GRUB, verifying the grub binary's signature against the one in the MOK key database. You can inspect this one with mokutil. This is the signature chain for the grub binary on my machine:

image signature issuers:
 - /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master Certificate Authority
image signature certificates:
 - subject: /C=GB/ST=Isle of Man/O=Canonical Ltd./OU=Secure Boot/CN=Canonical Ltd. Secure Boot Signing
   issuer:  /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master Certificate Authority

Other than that though, see if you can find any error messages or error logs from the failing boot process. They may point you in a more specific direction for debugging.

2
  • Jeremy Kerr, what were your installation steps with secure boot enabled? Everytime I boot with secure boot enabled, it would spit out an error "secure boot failed, operating system is invalid." – edgarej Feb 7 '17 at 13:13
  • 1
    I just installed Ubuntu and enabled secure boot in the firmware configuration UI. However, it's highly likely that your system firmware is in a different configuration to mine, possibly including having different secure boot certificates present. – Jeremy Kerr Feb 7 '17 at 13:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.