While trying to setup secureboot in custom Debian based system, grub is not loading if SB is on. I'm using shim (signed by MS) as first stage bootloader. Now I plan to use MOK to sign grub2 and kernels. So the steps are:

  1. Create priv and public key. Public key is in .der and .pem formats.

  2. 2.a. grub-mkstandalone --format x86_64-efi /boot/grub/grub.efi -o grub.efi.unsigned

    2.b sbsign --key ~/my.priv --cert ~/my.pem grub.efi.unsigned --output grub.efi

    2.cp grub.efi /boot/efi/EFI/mylinux/grubx64.efi

  3. mokutil --import my.der

  4. Reboot and enroll the key in MOK management

  5. Enable secureboot in UEFI settings and boot.

So what happens is shim gets loaded, but as it starts grub, it refuses to load module normal.mod with and error Secureboot forbids to load module (memdisk)/boot/grub/x86_64-efi/normal.mod. It drops to grub rescue shell.

So my question is if this problem is with MOK keys not loading properly? So I tested with the stock grub signed from Debian, signed by their key, trusted by shim. Then grub boot fine but ofc stops not finding config file. I can manually add that and boot. Signature verification is not enforced in grub settings. So Debian keys load fine.

My next doubt is something wrong with the procedure of creating grub. I read stuffs from SE, Debian and arch wiki etc, couldn't find any working solution.

Any insight is deeply appreciated.

1 Answer 1


When you use the grub-mkstandalone command, you need to pre-load the modules with --modules=module_list. secureboot can only use these modules in the list.


MODULES="all_video archelp boot bufio configfile crypto echo efi_gop efi_uga ext2 extcmd  \
fat font fshelp gcry_dsa gcry_rsa gcry_sha1 gcry_sha512 gettext gfxterm linux linuxefi ls \
memdisk minicmd mmap mpi normal part_gpt part_msdos password_pbkdf2 pbkdf2 reboot relocator \
search search_fs_file search_fs_uuid search_label sleep tar terminal verify video_fb"

grub-mkstandalone -d /usr/lib/grub/x86_64-efi -O x86_64-efi --modules "$MODULES" --pubkey gpg.key --output grubx64.efi  boot/grub/grub.cfg=grub.init.cfg boot/grub/grub.cfg.sig=grub.init.cfg.sig -v

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .