I'm trying to get my dual boot (Arch+Win10) to work with Secure Boot. I followed the Arch Wiki, with the following steps.

sudo mount /dev/sda1 /boot/efi
sudo mv /boot/efi/EFI/Boot/bootx64.efi /boot/efi/EFI/Boot/grubx64.efi
sudo cp /usr/share/shim-signed/shimx64.efi /boot/efi/EFI/Boot/bootx64.efi
sudo cp /usr/share/shim-signed/mmx64.efi /boot/efi/EFI/Boot/
sudo openssl req -newkey rsa:2048 -nodes -keyout MOK.key -new -x509 -sha256 -days 3650 -subj "/CN=MOK_LENOVO_MASSIMO/" -out MOK.crt
sudo openssl x509 -outform DER -in MOK.crt -out MOK.cer
sudo openssl x509 -outform DER -in MOK.crt -out MOK.cer
sudo sbsign --key MOK.key --cert MOK.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux
sudo sbsign --key MOK.key --cert MOK.crt --output /boot/efi/EFI/BOOT/grubx64.efi /boot/efi/EFI/BOOT/grubx64.efi
sudo cp MOK.cer /boot/efi/EFI/
systemctl reboot --firmware-setup

As I enabled Secure Boot the system booted direclty into windows (which is after the new "shim" bootx64.efi, still called "rEFInd Boot Manager", in the boot order).

Disabling SB got me to a working refind again, which, I guess, means that shim is properly configured, but the system does not reckognize its signed key? The Wiki and the refind site tell me I should be prompted with MOK tool, since Shim, signed with Microsoft key, can't chainload (a not yet signed) refind.

How do I make shim chainload MokManager?

EDIT: I had a look at the Shim source code and indeed it seems that, if there were errors, shim would print them happily (which doesn't happen). It just silently boot windows.


You have to either create your MOK and sign the bootloader with it or get a complementary shim+bootloader pair (as in "bootloader signed with the certificate that shim was compiled with") -- see also the excellent Rod's books on the topic (Dealing with Secure Boot, Controlling Secure Boot) as well as my UEFI SecureBoot mini-HOWTO if you're interested in helping Arch getting their shim signed by UEFI CA (== MSFT).

Getting a Linux distro that actually went through that pain for you might be way easier though (I know Fedora, SUSE, Ubuntu, ALT and ROSA as of today although there might be more).

PS: the exact (but useless) answer is that your shim works as intended already...

  • Excuse me, but I don't get why this should be the correct configuration... If shim works but doesn't prompt me with MOK tool, how could I ever sign the bootloader with it's key? Unfortunately the Arch mods don't want to follow the "official EFI signature" way (also because it follows the Rolling Release model, I guess?), but I like this distro much more than the others – Massimo Pesavento Sep 6 '18 at 18:35
  • It's not related to "rolling release" at all (as long as there's at least one shim-signed already), and MOK doesn't sign anything but can rather tell firmware that it should accept a particular binary by its hash (because that's what the machine owner wants explicitly). – Michael Shigorin Nov 14 '18 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.