MOK Enrollment Fails with Secure Boot on Ubuntu 24.04 LTS

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Signed third-party modules do not load after reboot with Secure Boot enabled.

Environment & Reproduction

Happens after DKMS driver install when MOK enrollment is skipped or fails.

Root Cause Analysis

Machine Owner Key is not enrolled, so kernel lockdown blocks module loading.

Quick Triage

Run mokutil –sb-state and mokutil –list-enrolled | head.

Step-by-Step Diagnosis

Check dmesg for ‘Lockdown’ and module signature errors after boot.

Solution – Primary Fix

Regenerate and enroll MOK via sudo update-secureboot-policy –enroll-key, then complete enrollment at reboot.

Solution – Alternative Approaches

Disable Secure Boot temporarily for troubleshooting only.

Verification & Acceptance Criteria

Required kernel modules load and related hardware functions return.

Rollback Plan

Revert to previously working signed module set if new key workflow fails.

Prevention & Hardening

Complete key enrollment immediately after driver installation.

Related Errors & Cross-Refs

Related: module verification failed and key rejected errors.

Related tutorial: View the step-by-step tutorial for Ubuntu 24.04 LTS.

View all Ubuntu 24.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu Secure Boot documentation and mokutil manual.