I would also like to add that I needed to turn Secure Boot off in BIOS to install Zorin 18 as having it on crashed during install.
After installing Zorin OS 18, I turned Secure Boot Back on.
Verified Secure Boot was on with command: mokutil --sb-state
Now at this point my Secure boot certificates were not enrolled in the MOK.
Perform the following steps after turning secure boot on:
1.) Check if Secure Boot certs are already on computer:
ls -lah /var/lib/shim-signed/mok/ ----> Directory listing secure boot key folder
There should be 3 files:
-rw-r--r-- 1 root root 919 Feb 13 08:30 MOK.der
-rw------- 1 root root 1.7K Feb 13 08:30 MOK.priv
-rw------- 1 root root 1.0K Feb 13 08:30 .rnd
If they are there (above 3 files) proceed to Step 3 otherwise you will need to generate secure boot certs in Step 2:
2.) Generate Secure Boot Certs:
update-secureboot-policy --new-key ----> Generate new secure-boot key
Now Repeat step #1 and check that there are 3 files: MOK.der, MOK.prov and .rnd
3.) Check and see if Secure Boot Certs are enrolled in MOK.
sudo mokutil --test-key /var/lib/shim-signed/mok/MOK.der -----> See if Secure Boot Key is enrolled
If the output says:
/var/lib/shim-signed/mok/MOK.der is already enrolled
If the output says "already enrolled" You are done and secure boot is setup.
If not then proceed to Step #4.
4.) Enroll Secure Boot certs/keys in MOK:
mokutil --import /var/lib/shim-signed/mok/MOK.der
After running the command above it will prompt for a passwsord... Enter a password...
I used my account/sudo password as it's easy to remember!
5.) After completing Step #4 you will need to reboot.
On rebooting you will see the MOK Utility come up immediatly after POST (The BIOS Power on Self Test when first powering up)
You will need to answer the MOK quickly as it has a 8 - 10 second or so timer and will flash on by if you are not paying attention!
6.) Enrolling Secure Boot Certs/Keys on Bootup/Startup:
You will see the MOK Manager... It is blue and looks like an old Commodore 64 screen... heheh
Be quick and select 'ENROLL MOK'
At this point you will see 'VIEW KEY 0' and 'CONTINUE' You can select VIEW KEY if desired to verify the start and expiration date(s)
and the expiration date is good for a 100 years... Wow better than Winblows Secure Boot Cert shelf life... Hehehe
After viewing the Certificate you can press enter to get back to the main MOK Mananger Screen
7.) Select 'Continue' in the MOK Mananger.
After selecting 'Continue' you will see 'Enroll the Key'
Select 'Yes' and you will be prompted for a password.
Enter the same password you used in Step #4.
8.) After entering the password you will be prompted to 'Reboot'
Make sure 'Reboot is highlighted and hit enter to reboot.
9.) ** After booting back up to the desktop you can verify the Secure Boot Keys are
enrolled by typeing at the terminal:
$ sudo mokutil --test-key /var/lib/shim-signed/mok/MOK.der
[sudo] password for scott:
/var/lib/shim-signed/mok/MOK.der is already enrolled
** If Step #9 was successful then Congtatulations! You have setup your Secure Boot Keys.
Note:
There is a Youtube video that I used to help me setup and enroll my Secure Boot Keys.
I also referenced the Youtube video to help in writing up these instructions.
Here is the link to that Youtube Video:
https://www.youtube.com/watch?v=O_aqPJ72p3E&t=1s
