Mok enrollment

[Frenchman]

Following a previous question on the forum, I need some help concerning a new problem I am facing with Zorin 17.2 updates. I am a beginner. Today, I had an update including new linux kernels. My secure boot is enabled and I am using a dual boot configuration (Zorin 17.2 / Ubuntu 24.04).
During the update process, I had the following screens:

Then a second screen:

I indicated a password and confirmed it. I waited a few minutes. Nothing happened. I rebooted and the following screen appeared:

[Frenchman]

I didn't know which option to choose. I tried to find some information on the web and during that time the computer just continued to boot. I didn't enter the created password.
When trying to update Zorin again through the desk, there were linux kernels files on the screen. I tried to install them. But they were deleted. I probably did something wrong. Now, there is a message saying that there are not new updates.
I have just disabled my secure boot.

1. Should I always switch it off?
2. If no, if that happens again, should I select enroll mok on the third screenshot? I suppose that I should enter the created password at that moment. What do the next screens look like?
3. Considering the fact that the last linux kernels haven't been installed, I suppose that the system hasn't been upgraded and that it may not work properly with some softwares.
   Is there a way to install them? (As a beginner, I don't know what to do.) Or should I wait until the next updates proposed by Zorin OS (just hoping there is no problem during that time)?
4. Trying to find a very easy solution, would it be better to reinstall Zorin without a dual boot and to disable Secure Boot permanently? Would that solve that Mok enrollment problem?
   Thanks for your answers.

[Frenchman]

5 I was thinking of another solution too. I installed Timeshift two weeks ago and I created an image of the system on January 16th. If I try to restore that image, would it be the solution if there are problems with the system because of the new missing linux updated kernels?

[Locklear93]

If your computer is Linux only (you mentioned Zorin and Ubuntu), life will be easier if you disable secure boot. There are reasons Windows needs it (more rootkits and firmware rootkits), but to my knowledge there's only one Linux firmware rootkit and it's more proof of concept than actually viable.

If you want to keep it, you need to enroll the MOK key and and tell the system where the key actually IS. The location I can't tell you I'm afraid.

If you're comfortable without Secure Boot, you can turn it off and run your dual boot fine. As for it not having prompted you for the password, it only wants that password when you're making changes to secure boot, such as enrolling new keys.

[Ponce-De-Leon]

The easiest Thing here is to let Secure Boot (and if available Fast Boot) turned off. It makes it more easier.

Because of the Kernel Thing: could You type in the Terminal uname -r please? It shows Your current Kernel Version. And then post it here.

[Frenchman]

Thanks for you help.

[Ponce-De-Leon]

That looks right. I have the same:

[StarTreker]

If you are not using Windows, and you are only using Linux distro's, I strongly recommend keeping "secure boot" and "fast boot" disabled in the BIOS. They cause serious issues in Linux, and shouldn't be used.

---