Hi and welcome.
Firstly I have never attempted this but because it is saying the key already exists you may need to identify it and see if you can remove it.
I used Mojeek search engine and then chose Brave search engine option which Mojeek offers, and the A.I. results came back with:
" How to identify efi keys in BIOS for Ubuntu 24.04
Quick Answer
To identify EFI keys and Secure Boot status for Ubuntu 24.04 , you must check the UEFI firmware settings or use Linux commands from a running system.
1. Via UEFI Firmware Setup
-
Restart your computer and press the manufacturer-specific key (commonly F2 , F10 , F12 , or Del ) to enter the UEFI/BIOS setup .
-
Navigate to the Security , Boot , or Authentication tab.
-
Look for Secure Boot settings. If enabled, it verifies that the bootloader (shim) and kernel are signed by trusted keys (typically Microsoft and Canonical ).
-
Some systems allow you to view enrolled keys under Key Management or MOK (Machine Owner Key) Manager .
2. Via Linux Terminal (Running Ubuntu)
If you can boot into Ubuntu, use these commands to verify key status:
- Check Secure Boot Status :
mokutil --sb-state
This outputs whether Secure Boot is enabled or disabled.
mokutil --list-enrolled
This displays the PK (Platform Key) , KEK (Key Exchange Key) , and db (Signature Database) keys enrolled in the UEFI firmware.
[ -d /sys/firmware/efi ] && echo "UEFI Mode" || echo "Legacy BIOS Mode"
3. Key Types in Ubuntu Secure Boot
-
Microsoft Windows PCA Key : Pre-installed in most UEFI firmware; allows Ubuntu’s shim bootloader to run.
-
Canonical Ubuntu Key : Embedded in shim ; allows GRUB and the Linux kernel to run.
-
MOK (Machine Owner Key) : Custom keys you can enroll to load third-party drivers (e.g., NVIDIA , VirtualBox ) if they are not signed by Canonical.
+16
How to enroll a custom MOK key?
To enroll a custom Machine Owner Key (MOK) on Ubuntu 24.04 , you must generate a key pair, import the public key into the MOK database, and confirm the enrollment via the UEFI firmware interface upon reboot.
1. Generate a Custom MOK Key Pair
Create a directory for your keys and generate a private key and a self-signed certificate using openssl . The certificate must be in DER format for UEFI compatibility.
sudo mkdir -p /root/mok
cd /root/mok
# Generate a 2048-bit RSA key and self-signed certificate (valid for 10 years)
sudo openssl req -new -x509 -newkey rsa:2048 \
-keyout MOK.priv \
-outform DER \
-out MOK.der \
-days 3650 \
-subj "/CN=My Custom MOK/" \
-nodes
# Secure the private key
sudo chmod 600 MOK.priv
how to enroll MOK key Ubuntu Secure Boot
View all
2. Import the Key for Enrollment
Use mokutil to queue the public key (MOK.der ) for enrollment. You will be prompted to create a temporary password (8–16 characters). Remember this password , as you must enter it in the blue MOK Manager screen during the next boot.
sudo mokutil --import /root/mok/MOK.der
3. Enroll the Key via MOK Manager
Reboot your system. Before Ubuntu loads, the Shim UEFI Key Management (blue screen) interface will appear automatically.
-
Select Enroll MOK and press Enter .
-
Select Continue and then Yes to confirm.
-
Enter the temporary password you created in Step 2.
-
Select Reboot to finish the process.
Ubuntu MOK enrollment blue screen issues site:reddit.com
View all
4. Verify Enrollment
Once the system boots, confirm that the key is successfully enrolled in the firmware database:
mokutil --list-enrolled | grep "My Custom MOK"
5. Sign Custom Kernel Modules
With the key enrolled, you can now sign third-party kernel modules (e.g., VirtualBox, custom drivers) so they load under Secure Boot:
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file \
sha256 \
/root/mok/MOK.priv \
/root/mok/MOK.der \
/path/to/your/module.ko
For DKMS modules, Ubuntu 24.04 can automatically sign modules if you place your keys at /var/lib/shim-signed/mok/MOK.priv and /var/lib/shim-signed/mok/MOK.der , or by configuring /etc/dkms/framework.conf ."
Before attempting any of the above:
-
Create a backup of the EFI keys to USB.
-
Create a complete system backup to an external hard drive using Rescuezilla
Note that you cannot use a mokutil database check in live mode:
" No , mokutil commands cannot be run in a standard Ubuntu Live mode because the utility requires write access to NVRAM variables to check or modify Secure Boot states.
-
Read-Only Environment: Live sessions typically mount the EFI System Partition (ESP) as read-only or do not have the necessary permissions to interact with the firmware's Secure Boot databases (db , dbx , KEK , PK ).
-
NVRAM Access: The mokutil tool relies on /sys/firmware/efi/efivars to communicate with the UEFI firmware. In many Live environments, this interface is either not mounted or restricted, preventing the tool from querying the current Secure Boot status or enrolled keys.
-
Workaround: To check Secure Boot status or MOK enrollment from a Live session, you must use tools that read the EFI variables directly without requiring NVRAM writes, such as efivar --list | grep -i secure or checking the SecureBoot variable in /sys/firmware/efi/efivars/ , though mokutil specifically is designed for installed systems where full NVRAM access is granted.
AI-generated answer. Please verify critical facts."
Lastly, if you are running an ESU of Windows 10 or Windows 11, there was a critical update to EFI which might prevent you from booting anything other than Windows on 24.06.2026.