NVIDIA fails to load with secure boot enabled

[skinj0b]

Fresh installation, fully updated before enabling NVIDIA driver, which worked fine until I enabled secure boot, which causes the driver to not load. Do I need to sign the driver? I am under the impression that NVIDIA signs drivers as I use Windows 11 Pro as well and by default, driver signatures are verified or they cannot load and I use the NVIDIA drivers as I game.

So please, If I could get some direction on this, it is very appreciated. Below is my hardware info, cleaned of dupes & dummies:

00:00.0 "Host bridge" "Advanced Micro Devices, Inc. [AMD]" "Starship/Matisse Root Complex" "Micro-Star International Co., Ltd. [MSI]" "Starship/Matisse Root Complex"
00:00.2 "IOMMU" "Advanced Micro Devices, Inc. [AMD]" "Starship/Matisse IOMMU" "Micro-Star International Co., Ltd. [MSI]" "Starship/Matisse IOMMU"
00:07.1 "PCI bridge" "Advanced Micro Devices, Inc. [AMD]" "Starship/Matisse Internal PCIe GPP Bridge 0 to bus[E:B]" "" ""
00:08.0 "Host bridge" "Advanced Micro Devices, Inc. [AMD]" "Starship/Matisse PCIe Dummy Host Bridge" "" ""
00:08.1 "PCI bridge" "Advanced Micro Devices, Inc. [AMD]" "Starship/Matisse Internal PCIe GPP Bridge 0 to bus[E:B]" "" ""
00:14.0 "SMBus" "Advanced Micro Devices, Inc. [AMD]" "FCH SMBus Controller" -r61 "Micro-Star International Co., Ltd. [MSI]" "FCH SMBus Controller"
00:14.3 "ISA bridge" "Advanced Micro Devices, Inc. [AMD]" "FCH LPC Bridge" -r51 "Micro-Star International Co., Ltd. [MSI]" "FCH LPC Bridge"
01:00.0 "Non-Volatile memory controller" "Realtek Semiconductor Co., Ltd." "Device 5765" -r01 -p02 "Realtek Semiconductor Co., Ltd." "Device 5765"
02:00.0 "USB controller" "Advanced Micro Devices, Inc. [AMD]" "Device 43ee" -p30 "ASMedia Technology Inc." "Device 1142"
02:00.1 "SATA controller" "Advanced Micro Devices, Inc. [AMD]" "Device 43eb" -p01 "ASMedia Technology Inc." "Device 1062"
04:00.0 "Non-Volatile memory controller" "Realtek Semiconductor Co., Ltd." "Device 5765" -r01 -p02 "Realtek Semiconductor Co., Ltd." "Device 5765"
05:00.0 "Network controller" "MEDIATEK Corp." "Device 0608" "MEDIATEK Corp." "Device 0608"
2a:00.0 "Ethernet controller" "Realtek Semiconductor Co., Ltd." "RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller" -r15 "Micro-Star International Co., Ltd. [MSI]" "RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller"
2b:00.0 "VGA compatible controller" "NVIDIA Corporation" "Device 2507" -ra1 "Micro-Star International Co., Ltd. [MSI]" "Device c979"
2b:00.1 "Audio device" "NVIDIA Corporation" "Device 228e" -ra1 "Micro-Star International Co., Ltd. [MSI]" "Device c979"
2d:00.0 "Non-Essential Instrumentation [1300]" "Advanced Micro Devices, Inc. [AMD]" "Starship/Matisse Reserved SPP" "Micro-Star International Co., Ltd. [MSI]" "Starship/Matisse Reserved SPP"
2d:00.1 "Encryption controller" "Advanced Micro Devices, Inc. [AMD]" "Starship/Matisse Cryptographic Coprocessor PSPCPP" "Micro-Star International Co., Ltd. [MSI]" "Starship/Matisse Cryptographic Coprocessor PSPCPP"
2d:00.3 "USB controller" "Advanced Micro Devices, Inc. [AMD]" "Matisse USB 3.0 Host Controller" -p30 "Micro-Star International Co., Ltd. [MSI]" "Matisse USB 3.0 Host Controller"
2d:00.4 "Audio device" "Advanced Micro Devices, Inc. [AMD]" "Starship/Matisse HD Audio Controller" "Micro-Star International Co., Ltd. [MSI]" "Starship/Matisse HD Audio Controller"

[Aravisian]

@skinj0b

Fresh installation, fully updated before enabling NVIDIA driver, which worked fine until I enabled secure boot, which causes the driver to not load. Do I need to sign the driver?

Yes, the Drivers must be signed for use on GnuLinux, not just on Windows.
The signatures exist, you only need to access them with MOK.

I do not use Windows and therefor, I do not use Secure Boot so I am not well qualified to detail a descriptive guide.
You might find help in existing guides online:

How to install nvidia driver with secure boot enabled?

[Winged1]

When setting-up mok on a Zorin/Win 11 dual drive dual boot there was no need to download a driver from nvidia. I used a proprietary nvidia driver available in the repository. I was able to check all the security boxes for Win 11. I did have to install the mokutil package from the repository.

david@d-box:~$ mokutil --sb-state
SecureBoot enabled
david@d-box:~$ ls /sys/firmware/efi
config_table  esrt              fw_vendor      runtime      systab
efivars       fw_platform_size  mok-variables  runtime-map  vars
david@d-box:~$ dmesg | grep -i tpm
[    0.000000] efi: ACPI 2.0=0x9eb4f000 ACPI=0x9eb4f000 TPMFinalLog=0x9ebb9000 SMBIOS=0x9f539000 MEMATTR=0x9a6b6018 ESRT=0x9b4fff98 MOKvar=0x9f550000 RNG=0x9e71d018 TPMEventLog=0x8c5ac018 
[    0.013444] ACPI: TPM2 0x000000009EB9ECF8 000034 (v04 ALASKA A M I    00000001 AMI  00000000)
[    0.013470] ACPI: Reserving TPM2 table memory at [mem 0x9eb9ecf8-0x9eb9ed2b]

[PlumpKibbles]

I purposely installed Zorin ~3 times in a row trying out secure boot enabled Zorin. In the 'short' run, I did the initial install, reboot, login, install shim-signed, run mokutil and set pw, reboot, enter BIOS and enable secure boot - save and exit, will boot to mokutil blue screen - not of 'death' - entered pw, enabled secure boot again through mokutil, reboot, install Nvidia proprietary, run mokutil again to finish Nvidia install and.. it worked.. Though - on my end, along with having the provided shim package, I also had to install shim-signed, and before starting the process. I'm not sure why, I've seen a few posts with others that had to do the same; shim just wasn't enough for my setup apparently? Not saying that's anything you're having issues with though.

With secure boot enabled, I ran it like that for about 2 years (first year with it disabled before trying it out randomly) then.. some weird issue happened, couldn't get it sorted out - some flatpaks were in an install / uninstall loop, that's all that would happen.. weird. So, made a current back up and just reinstalled, no secure boot this time though; all is well! I will have to say - Zorin was the first distro I tried getting secure boot working with, period. I never even attempted it before..

Nvidia drivers take a few more steps, that's all - plus the added security

[Ocka]

Gday @skinj0b Welcome to the community!
Please keep us updated on your progress, if needed.
If you have fixed the issue, please let us know how you fixed it.
This could help other user's in the future.

Zorin forum community.