Arch Linux

maxpesa

Member

From: Italy

Registered: 2017-07-10

Posts: 11

Shim does not work with Secure Boot enabled

Hi, I have a properly working rEFInd as boot manager (with a non-default configuration), which loads Arch and Win10 with Secure Boot disabled.
I wanted to re-enable Secure Boot, so I followed the Arch Wiki with these steps:

 
sudo mount /dev/sda1 /boot/efi
sudo mv /boot/efi/EFI/Boot/bootx64.efi /boot/efi/EFI/Boot/grubx64.efi
sudo cp /usr/share/shim-signed/shimx64.efi /boot/efi/EFI/Boot/bootx64.efi
sudo cp /usr/share/shim-signed/mmx64.efi /boot/efi/EFI/Boot/
sudo openssl req -newkey rsa:2048 -nodes -keyout MOK.key -new -x509 -sha256 -days 3650 -subj "/CN=MOK_LENOVO_MASSIMO/" -out MOK.crt
sudo openssl x509 -outform DER -in MOK.crt -out MOK.cer
sudo openssl x509 -outform DER -in MOK.crt -out MOK.cer
sudo sbsign --key MOK.key --cert MOK.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux
sudo sbsign --key MOK.key --cert MOK.crt --output /boot/efi/EFI/BOOT/grubx64.efi /boot/efi/EFI/BOOT/grubx64.efi
sudo cp MOK.cer /boot/efi/EFI/
systemctl reboot --firmware-setup

However, after I enabled Secure Boot the system booted direclty into windows (which is after the new "shim" bootx64.efi, still called "rEFInd Boot Manager", in the boot order).
Disabling SB got me to a working refind again, which, I guess, means that shim is properly configured, but the system does not reckognize its signed key? The Wiki and the refind site tell me I should be prompted with MOK tool.
How do I make shim work?

Feel free to move this post, I don't know what's the proper subforum.

Last edited by maxpesa (2018-09-04 19:05:04)

---

There are no passengers on spaceship earth. We are all crew.