When I installed my RL9 system Secure Boot was not enabled. Now I want to enable it but the x509 certificates need to be loaded first. I assume the mokutil is the tool to load the certs but where are they stored?

Rocky Linux secure boot will work with the default (Microsoft) secure boot certificates loaded by your OEM.

There was no OEM or I should say that was me. Or are you saying MB’s are manufactured with MS certs installed? Mokutil only shows the Rocky Cert. # mokutil -l [key 1] SHA1 Fingerprint: 0e:2a:bf:72:66:32:95:3a:d2:05:b3:cd:c7:eb:24:15:8b:31:b3:bb Certificate: Data: Version: 3 (0x2) …

Yes, pretty much all UEFIs are configured to trust only certificates signed by Microsoft. This was the cause of much consternation when secure boot was first coming out, because there was the expectation that Microsoft would abuse secure boot by refusing to sign the secure boot certificates of alte…

To elaborate, that mokutil command only lists the Rocky CA that is embedded in our shim. To see the ones in your UEFI’s db and kek databases, use: mokutil --db and mokutil --kek . Unless your hardware is very unusual, you will have Microsoft issued certificates included in these databases on your…

[image] skip77: Turning on secure boot shouldn’t affect anything, unless you’ve put a custom-built kernel on your system or 3rd-party drivers. Of the latter, at least the kernel modules from ELRepo are signed, (but with ELRepo’s key so one has to install ELRepo’s CA with mokutil).

I have Secure Boot enabled now on my Rocky server. I don’t have elrepo kernels or external modules. The biggest hurdle is fathoming the firmware routine. Once the platform key and rocky key are enrolled all worked as expected. The rocky cert is embedded in the shimx64.efi file that you need to point…

Post Install Enabling Secure Boot

Rocky Linux Help & Support

jlehtone January 28, 2023, 10:34pm 6

Of the latter, at least the kernel modules from ELRepo are signed, (but with ELRepo’s key so one has to install ELRepo’s CA with mokutil).

Topic		Replies	Views
Rocky Linux 8.5 UEFI Secure Boot Key problem on VMware Rocky Linux Help & Support	8	3852	August 25, 2023
How to enable secure boot on Rocky 8.5 Rocky Linux Help & Support	4	4877	August 25, 2023
Secure Boot Status Rocky Linux Help & Support	10	5458	August 24, 2023
Rocky is not bootable Rocky Linux Help & Support	20	6894	August 25, 2023
Missing driver: drivers/usb/serial/f81232.c Rocky Linux Help & Support rocky-linux-9	11	200	October 21, 2025

Post Install Enabling Secure Boot

Related topics