Fixing Nvidia and VirtualBox Drivers Blocked by Secure Boot: A Kernel Module Signing Guide – ITFROMZERO

You’ve just “unboxed” the latest version of Ubuntu 22.04 or Fedora and installed the Nvidia drivers for AI work or graphics. But after a reboot, the driver still isn’t recognized, and your screen is stuck at a low resolution. Running the command lsmod | grep nvidia yields no results, while dmesg reports a glaring red error: “Required key not available”.

The main culprit is Secure Boot. This is a security layer at the BIOS/UEFI level that prevents malicious code from loading into the operating system kernel. It only allows Kernel Modules that have been digitally signed by Microsoft or the manufacturer (OEM) to execute.

Nvidia or VirtualBox drivers are often compiled (built) directly on your machine during installation. Because they are built locally, they lack a valid digital signature. Instead of disabling Secure Boot and making your computer less secure, we will create our own set of keys and tell the system to trust them. This technique utilizes MOK (Machine Owner Key).

Table of Contents

Why Perform Manual Signing?

Typically, distributions like Ubuntu handle this automatically if you use drivers from the official repositories. However, if you install the latest drivers from the Nvidia website or use specific modules, the system will skip the signing step.

In reality, about 90% of users dual-booting Windows and Linux on modern gaming laptops (such as ASUS ROG or Dell XPS) encounter this issue. Self-signing effectively makes you a trusted “publisher” on your own device.

Step 1: Install Key Management Tools

First, you need a suite of tools to create and manage MOK certificates. On Ubuntu/Debian, open your Terminal and run:

sudo apt update
sudo apt install openssl mokutil shim-signed

For those using Fedora or RHEL, the corresponding command is:

sudo dnf install openssl mokutil

Step 2: Create a Machine Owner Key (MOK) Pair

We will create a key pair consisting of: a private key for signing and a public certificate to be loaded into the BIOS.

For security, store the keys in the root directory:

sudo mkdir -p /root/mok-keys
cd /root/mok-keys

# Create a 2048-bit RSA key valid for 100 years
sudo openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 36500 -subj "/CN=My Linux Driver Key/"

After running this, you will see the files MOK.priv and MOK.der. Never expose the .priv file if you want to keep your system secure.

Step 3: Register the Key with the System (Import)

Now, add the public certificate to the system’s enrollment queue:

sudo mokutil --import MOK.der

The system will ask you to set a password. Remember it. You will use this password only once when you reboot your computer in the next step.

Step 4: Confirm in the Blue Screen (MOK Manager)

This is the crucial step. Reboot your computer. Immediately after the manufacturer’s logo, a blue screen (usually a text interface) titled Perform MOK management will appear.

Select Enroll MOK.
Select View key 0: Check if the name matches “My Linux Driver Key” that you just created.
Select Continue -> Yes to confirm.
Enter the password you set in Step 3 (note: the keyboard may default to the US layout).
Select Reboot.

If you accidentally select “Continue boot” without enrolling, the driver will remain blocked. In that case, you must run the mokutil --import command again.

Step 5: Sign the Drivers

Once you are back in Linux, use the created key to “stamp” the driver files (.ko extension). First, you need to find the location of the Kernel’s signing script:

# Find the path to the sign-file script
KBUILD_DIR=$(find /lib/modules/$(uname -r) -name "sign-file" | head -n 1)

Now, sign the Nvidia modules. The command below will automatically find the module path and perform the signing:

sudo perl "$KBUILD_DIR" sha256 /root/mok-keys/MOK.priv /root/mok-keys/MOK.der $(modinfo -n nvidia)

For VirtualBox, you need to sign the 4 main modules (vboxdrv, vboxnetadp, vboxnetflt, vboxpci):

sudo perl "$KBUILD_DIR" sha256 /root/mok-keys/MOK.priv /root/mok-keys/MOK.der $(modinfo -n vboxdrv)

Step 6: Verify the Results

Try reloading the module using the modprobe command. If no error messages appear, you have succeeded:

sudo modprobe nvidia
# Check if the signature has been attached
modinfo nvidia | grep signature

Pro Tip: Automate with DKMS

Every time Linux updates to a new Kernel (e.g., from 6.5 to 6.8), the driver signatures will be wiped. To avoid manual signing every week, you should configure DKMS.

On newer Ubuntu versions, if you copy the key pair to /var/lib/shim-signed/mok/, DKMS will automatically sign the modules every time a new one is built. This ensures the system remains stable without manual intervention.

Secure Boot is not the enemy. Once you have mastered MOK, you can run high-performance drivers while maintaining a solid security barrier for your computer.