I re-enabled secure boot on an existing system. It then refused to boot the installed Debian 7, or my boot disc for Fedora 20 Live. I'm sure Fedora Live passed secure boot on this system before. However there was also an old Ubuntu install, which was able to get as far as GRUB (if I selected Ubuntu from the UEFI boot menu).

I was surprised because this doesn't match my vague understanding of Secure Boot. How could this happen?

The headline for UEFI secure boot is that linux distros use a key derived from Microsoft. I don't remember manually installing any secure boot keys on this system, i.e. that would let Ubuntu boot but not Debian/Fedora Live. So I wonder what sort of automatic processes might have caused it?


An old FSF paper suggests that Ubuntu installs a boot-loader (GRUB) signed with their own key, with no link to Microsoft's. The install media relies on the usual Microsoft key.[1][2]

It implies that the Ubuntu install process loads the Ubuntu key into your UEFI.

So perhaps I cleared the UEFI keys at some point, and then Ubuntu (perhaps its install disc) restored the Ubuntu key but not the Microsoft one.

I'm not 100% sure though. I'm not running any further tests.

[1] apparently it's not possible to have a boot-loader signed using two different keys, i.e. Ubuntu's and Microsoft's key at the same time.

[2] and if you're wondering why they do this - I'm not exactly sure, but apparently Ubuntu want Ubuntu-certified hardware to include Ubuntu's keys as well. This would let you remove Microsoft's key and still boot your Ubuntu install (when/if you use a generic rescue disc, you'd have to disable secure boot).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.