How to enroll keys for secure boot?

Ask Fedora
, , ,
1

I bought a pretty cheap, non-namebrand mini PC. Thing is, it didn’t come with any secureboot keys preinstalled.

evan@fedora:~$ mokutil --pk
evan@fedora:~$ mokutil --kek
evan@fedora:~$ mokutil --db
evan@fedora:~$ mokutil --dbx
evan@fedora:~$ mokutil --list-enrolled 
2bb010e24d fedoraca

So it’s stuck in Setup Mode for now. Note that Secureboot is technically enabled.

evan@crybaby:~$ mokutil --sb-state
SecureBoot disabled
Platform is in Setup Mode

Ideally I would like to add a key owned by Fedora and not use a Microsoft key since they sign so much more stuff. But I think Fedora only signs with a Microsoft key. I’m not sure how I’m supposed to get the Microsoft key to add it.

In the BIOS, when attempting to enroll a key, it puts me into EFI and has me look for a key or hash there.

Edit 1: The Arch Wiki includes some information, but most of it goes over my head: Unified Extensible Firmware Interface/Secure Boot - ArchWiki

Edit 2: Found this: Windows Secure Boot Key Creation and Management Guidance | Microsoft Learn, still not exactly sure how to add it.

1 Like
3

This means that the system have no keys at all and you have to install them into dp and kek and finally into pk. Storing a key into pk will take the system out of Setup Mode.

Take a look at the sbctl project which should be able to do this task. You can search for "sbctl" in your favorite search engine for more information.

You can find the current Fedora key at https://src.fedoraproject.org/rpms/shim-unsigned-x64.git.

4 Likes
4

How do I get the Fedora key from that link? I extracted the RPM and the only thing relevant seemed to be shimx64.hash. I enrolled that to my system with

sudo sbctl import-keys ./shimx64.hash
sudo sbctl enroll-keys

That did some add somes keys,

evan@fedora:~/git/sbctl$ ./sbctl list-enrolled-keys
KEK:
  Key Exchange Key
DB:
  Database Key
PK:
  Platform Key

and activated Secureboot, but then I got a secureboot error about the invalid signature. So I don’t think I imported the right thing and/or I also need a Microsoft key?

5

sudo sbctl enroll-keys --microsoft

1 Like
6

@thephatlee that worked, thanks!

In summary, this is what I had to do to fix my issue.

  1. Install sbctl - they have a repo for it, but I manually compiled it since it does not work in toolbox and I didn’t want to install it on my host (Fedora Silverblue). Thankfully it was very easy. In toolbox, I ran these commands to compile it.
sudo dnf install golang asciidoc
mkdir build && cd build
git clone https://github.com/foxboron/sbctl.git
cd sbctl
make

From here, I left the toolbox and could run ./sbctl to run the program.

  1. Run sudo ./sbctl enroll-keys --microsoft
  2. Reboot