Booting in Insecure mode

Question

Hi, I had to reinstall Ubuntu and since then my XPS 9370 always says 'Booting in insecure mode' even though Secure Boot is enabled in UEFI BIOS. Does this have anything to do with with Expert Key Management's keys not being correct? And if so, how do I add or generate or whatever new keys?  And what key (there's PK, KEK, db, dbx) ? Thanks in advance for helping me out !

jphughan · Answer

UPDATE: Found this link.  So apparently the bootloader itself passes Secure Boot, which is enough to satisfy the firmware, but then it turns around and loads the OS, which can optionally ignore Secure Boot validation.  The command in the post marked as an answer may help you though: https://askubuntu.com/questions/726052/ubuntu-booting-in-insecure-mode-with-secureboot-enabled

jphughan · Answer

If you have Secure Boot enabled in the BIOS, then it's not possible to boot in insecure mode.  Secure Boot causes the system's UEFI firmware to refuse to boot from any bootloader that isn't signed.  You shouldn't have to mess with embedded keys and certificates for Secure Boot, because newer Ubuntu bootloaders are signed by an authority whose certificate is already included by default on systems that use Secure Boot. Although if you already messed around with that, I'm not sure what to tell you.  You might want to consider restoring your BIOS settings to their defaults in that case, although I don't know if that will reset your certificate store since I've never tested that.

THX-101 · Answer

Reinstalled and upgraded to Ubuntu 18.04. During the upgrade I was asked to generate MOK keys and to supply a temporary password. After rebooting you are asked to give the password and then 'Enroll MOK'. I **bleep** up the password last time since I use an AZERTY keyboard layout, but the system starts in US-INTERNATIONAL keyboard layout.

Average PC user

About me

Average PC user's Activities

Engagement Stats

Member Stats