Well spotted. Corrected. 
1 Like
I agree, it wasn't easy to fix and took a while. but I got there in the end - this is what I did to fix and I did not have to disable secure boot
Fixing NVIDIA “Key was rejected by service” on Zorin OS with Secure Boot enabled
The problem
I was troubleshooting an NVIDIA driver issue on Zorin OS with Secure Boot enabled. The machine has an NVIDIA GeForce RTX 4070 Ti SUPER, and the installed NVIDIA driver version was 580.178.04.
The NVIDIA driver appeared to be installed, but the kernel would not load the NVIDIA module. Graphics initialisation was failing, and the system could fall back to software rendering (llvmpipe).
The critical error was:
ERROR: could not insert 'nvidia': Key was rejected by service
The important discovery was that this was not simply a case of the NVIDIA driver being absent. The kernel module existed and was signed, but the signing key needed to be trusted by the system.
The investigation pointed to a Machine Owner Key (MOK) enrolment problem.
1. Check Secure Boot status
First, check whether Secure Boot is enabled:
mokutil --sb-state
The expected output when enabled is similar to:
SecureBoot enabled
Check the running kernel:
uname -r
During our troubleshooting, the kernel was:
7.0.0-34-generic
Check whether NVIDIA can communicate with the GPU:
nvidia-smi
If the NVIDIA module cannot load, this command may fail or report that it cannot communicate with the NVIDIA driver.
2. Reproduce the kernel-module error
Try loading the NVIDIA module directly:
sudo modprobe nvidia
Our result was:
ERROR: could not insert 'nvidia': Key was rejected by service
This error is particularly important when Secure Boot is enabled. The kernel can reject a module when its signing certificate is not trusted.
3. Confirm that the NVIDIA module exists and is signed
Find the module:
modinfo -n nvidia
Our NVIDIA module was located at:
/lib/modules/7.0.0-34-generic/updates/dkms/nvidia.ko.zst
Check the signing information:
modinfo -F signer nvidia
Our output identified the signer as:
zorin Secure Boot Module Signature key
We also checked the module's signing-key identifier:
modinfo -F sig_key nvidia
The value recorded during troubleshooting was:
3B:FF:65:79:50:70:D9:E3:EB:F4:CA:7D:E4:6F:44:14:F8:A0:95:37
This confirmed that the module had signing information. However, a signed module is not necessarily a module signed by a key the kernel trusts.
4. Check the Zorin MOK certificate
We found the certificate at:
/var/lib/shim-signed/mok/MOK.der
Check whether that certificate is enrolled:
sudo mokutil --test-key /var/lib/shim-signed/mok/MOK.der
The important finding was that this certificate was not enrolled.
Its recorded SHA-1 certificate fingerprint was:
A3:00:41:85:34:E5:EB:22:93:7E:5D:93:EE:FC:9C:78:AA:31:D2:09
We had also found an older enrolled MOK fingerprint. This was a useful reminder that having a MOK enrolled does not automatically mean that the certificate relevant to the current NVIDIA module is enrolled.
The certificate we needed to investigate was the one at /var/lib/shim-signed/mok/MOK.der.
5. Import the certificate for enrolment
The next step was to request enrolment of the certificate:
sudo mokutil --import /var/lib/shim-signed/mok/MOK.der
The command prompts you to create a temporary password.
This is a one-time password used to confirm the enrolment during the next boot. It is not your Linux login password.
Keep it available until the enrolment is complete.
6. Reboot and enrol the MOK
Reboot the machine:
sudo reboot
On the next boot, the Machine Owner Key Manager should appear with a blue enrolment screen if the request is pending.
Follow these steps:
- Select Enroll MOK.
- Select Continue.
- Select Yes to enrol the key.
- Enter the temporary password created in the previous step.
- Select the option to reboot.
The exact wording may vary slightly between versions.
The key point is to complete the enrolment in MOK Manager. Running mokutil --import alone only schedules the enrolment; it does not complete it.
7. Verify that the key is enrolled
Once Zorin OS has booted again, check Secure Boot:
mokutil --sb-state
Confirm that the certificate is enrolled:
sudo mokutil --test-key /var/lib/shim-signed/mok/MOK.der
The result should indicate that the certificate is enrolled.
If it still reports that the key is not enrolled, do not assume the fix worked. Check whether the MOK enrolment screen appeared and whether the enrolment was completed successfully.
8. Load NVIDIA and verify the GPU
Try loading the module again:
sudo modprobe nvidia
If there is no error, check the driver:
nvidia-smi
A successful result should display the NVIDIA GPU, the installed driver version and associated GPU information.
Check that NVIDIA modules are loaded:
lsmod | grep '^nvidia'
Finally, check which graphics renderer is being used:
glxinfo -B | grep -E 'direct rendering|OpenGL renderer|OpenGL version'
If glxinfo is unavailable, it is provided by the mesa-utils package.
The important thing is to confirm that the system is using the NVIDIA GPU rather than continuing to fall back to llvmpipe.
Why this matters
Secure Boot checks whether kernel modules are signed by a trusted key. Installing a driver and signing its module are not necessarily enough: the corresponding certificate must also be trusted by the boot chain.
MOK enrolment allows the system to trust a locally managed signing certificate without requiring Secure Boot to be permanently disabled.
The lesson from this troubleshooting session: when NVIDIA reports Key was rejected by service on a Secure Boot-enabled Linux installation, check the module's signing information and the enrolment status of the relevant MOK certificate before assuming the driver needs to be reinstalled.
Important note
These steps apply when the module is signed with the certificate being enrolled. If the error persists, verify that the certificate actually corresponds to the module's signing key and inspect the kernel logs before making further changes. Do not assume that enrolling an unrelated or outdated certificate will fix the problem.
Commands that can help with further diagnosis include:
sudo journalctl -k -b | grep -iE 'nvidia|secure boot|lockdown|verification|key'
The goal is to get the NVIDIA driver working while retaining Secure Boot, rather than treating disabling Secure Boot as the permanent solution.
2 Likes
Thanks for share information