Arch Linux

deepefimgr

Member

Registered: 2023-07-10

Posts: 1

Verifacation Error while setting up secure boot with shim keys

After setting up secure boot with shim keys I'm stuck on mok manager with a verification failed error.

Verification Failed: (0x1A) Security Violation

Here's the Steps i followed:
During Arch Installation:

# grub-install --target=x86_64-efi --efi-directory=esp --bootloader-id=GRUB --modules="normal test efi_gop efi_uga search echo linux all_video gfxmenu gfxterm_background gfxterm_menu gfxterm loadenv configfile tpm"
# grub-mkconfig -o /boot/grub/grub.cfg

After Installation:

# mv esp/EFI/BOOT/BOOTx64.EFI esp/EFI/BOOT/grubx64.efi
# cp /usr/share/shim-signed/shimx64.efi esp/EFI/BOOT/BOOTx64.EFI
# cp /usr/share/shim-signed/mmx64.efi esp/EFI/BOOT/
# efibootmgr --unicode --disk /dev/sdX --part Y --create --label "Shim" --loader /EFI/BOOT/BOOTx64.EFI
$ openssl req -newkey rsa:4096 -nodes -keyout MOK.key -new -x509 -sha256 -days 3650 -subj "/CN=my Machine Owner Key/" -out MOK.crt
$ openssl x509 -outform DER -in MOK.crt -out MOK.cer
# sbsign --key MOK.key --cert MOK.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux
# sbsign --key MOK.key --cert MOK.crt --output esp/EFI/BOOT/grubx64.efi esp/EFI/BOOT/grubx64.efi

04tm34l

Member

Registered: 2021-04-22

Posts: 32

Re: Verifacation Error while setting up secure boot with shim keys

In your environment, it would be better to enroll the db key in UEFI.
What I did is described in this thread.
I hope I can help.