How to Verify, Activate, or Turn Off Secure Boot on Linux

Secure Boot is a UEFI feature that checks every piece of startup software against a database of trusted cryptographic signatures. If anything in the boot chain fails verification, the system halts. This blocks rootkits and boot-level malware before your OS ever loads.

How Secure Boot Works on Linux

The firmware stores three types of keys that control what runs at boot:

At startup, the firmware checks the bootloader’s signature against the db. The bootloader then checks the kernel. Both must pass before the OS runs. Distributions like Ubuntu, Fedora, and openSUSE ship pre-signed bootloaders and work with Secure Boot out of the box.

How to Check Secure Boot Status on Linux

Open a terminal and run:

$ sudo mokutil --sb-state

The output shows either SecureBoot enabled or SecureBoot disabled. The mokutil utility comes with the shim package on most distributions. If it is missing, install shim through your package manager.

To inspect the firmware variable directly:

$ cat /sys/firmware/efi/efivars/SecureBoot-*

How to Enable Secure Boot on Linux

Secure Boot is toggled from your firmware setup screen, not from within Linux itself.

1. Restart your computer and press the firmware key during POST — commonly F2, Del, or Esc.
2. Navigate to the Security or Boot tab.
3. Find the Secure Boot option and set it to Enabled.
4. Save your settings and exit.

How to Disable Secure Boot on Linux

Disable Secure Boot when a third-party driver, custom kernel, or unsigned bootloader blocks your system from starting.

1. Restart and enter firmware setup using the appropriate key for your hardware.
2. Go to the Security or Boot section.
3. Set Secure Boot to Disabled.
4. Save and reboot.

Disable Secure Boot Validation from the Terminal (Ubuntu/Debian)

On systems using shim, you can disable Secure Boot validation without entering firmware:

$ sudo mokutil --disable-validation

Enter a temporary password (8–16 digits) when prompted. Reboot, then follow the on-screen MOK management prompts to confirm. To re-enable validation later:

$ sudo mokutil --enable-validation

How to Sign a Custom Kernel for Secure Boot

If you compile your own kernel, you must sign it before the firmware will accept it. On Debian-based systems, install the signing tools first:

# apt-get install sbsigntools

Generate a signing key and self-signed certificate:

$ openssl req -new -x509 -newkey rsa:2048 \
  -subj "/CN=CustomKernel/" \
  -keyout MOK.key -out MOK.crt \
  -days 3650 -nodes

Sign the kernel image:

$ sbsign --key MOK.key --cert MOK.crt \
  /boot/vmlinuz -o /boot/vmlinuz.signed

Import the certificate into the Machine Owner Key list:

$ sudo mokutil --import MOK.crt

Reboot and follow the on-screen prompts to enroll the key. After enrollment, the firmware trusts your signed kernel.

Practical Tips for Managing Secure Boot on Linux

• After any kernel or bootloader update, confirm the new files are correctly signed before rebooting.
• Review boot-time signature errors with journalctl -b | grep -i secureboot.
• Check firmware variables at /sys/firmware/efi/efivars/ to inspect current key state.
• Pair Secure Boot with a firewall and regular package updates — it only protects the boot chain, not the running system.