How to Use the mokutil Command in Linux to Manage Secure Boot Keys and MOK Enrollment

UEFI Secure Boot is an essential hardware-level security standard designed to prevent malicious rootkits and unauthorized bootloaders from executing during the computer initialization sequence. In Linux environments, Secure Boot operates through the Shim bootloader, which contains Microsoft-signed cryptographic certificates alongside a dedicated database known as the Machine Owner Key (MOK) list. The mokutil command-line utility serves as the primary administrative tool in Linux to query, enroll, export, and revoke cryptographic certificates within this MOK database.

When compiling out-of-tree kernel modules—such as proprietary NVIDIA graphics drivers, VirtualBox host kernel extensions, or custom ZFS storage modules—the Linux kernel will refuse to load unsigned binary modules if Secure Boot is enforced. Using mokutil, system administrators can sign these custom modules with their own private keys and authorize the corresponding public certificate in UEFI firmware, maintaining strict Secure Boot integrity without disabling system-wide protection.

Installing and Verifying mokutil on Linux

The mokutil package is available in the official package repositories of all major Linux distributions, including Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, openSUSE, and Arch Linux.

To install mokutil on Debian and Ubuntu systems:

sudo apt update
sudo apt install mokutil shim-signed

To install on Fedora and RHEL systems:

sudo dnf install mokutil shim-x64

To install on Arch Linux:

sudo pacman -S sbsigntools

Checking Secure Boot Status via Terminal

Before managing keys, determine whether UEFI Secure Boot is actively enforced on your system by executing:

mokutil --sb-state

The command will return one of two operational states:

• SecureBoot enabled: The UEFI firmware verifies kernel and driver signatures before execution.
• SecureBoot disabled: Unsigned kernels and third-party modules can load without cryptographic validation.

Querying Existing Enrolled Keys in the MOK Database

To view the cryptographic keys currently authorized in your system’s firmware MOK database, execute:

mokutil --list-enrolled

This command outputs detailed X.509 certificate attributes for each enrolled key, including the Certificate Authority issuer, valid date ranges, fingerprint hashes (SHA1/SHA256), and Subject details (such as the distribution maintainer or local administrator name).

If you only want to review pending key requests waiting for next-boot confirmation, run:

mokutil --list-new

How to Enroll a Custom Key into the MOK Database

When you generate a custom public/private X.509 key pair to sign local kernel modules (for example, MOK.der), you must enroll the public certificate into the UEFI firmware.

Step 1: Stage the Public Certificate with mokutil

Run the import command with administrative privileges, pointing to your binary DER-format certificate:

sudo mokutil --import /root/MOK.der

The terminal will prompt you to enter and confirm a temporary password. This one-time password protects against unauthorized key injection and will be requested during the physical reboot phase.

Step 2: Complete Enrollment via the UEFI Shim Screen (MokManager)

Because UEFI security forbids runtime user-space programs from directly altering firmware NVRAM without user confirmation, the enrollment must be verified at the physical console:

1. Reboot the system:

   sudo reboot

2. During the initial boot cycle before the GRUB menu appears, the blue MokManager utility will load automatically.
3. Press any key within 10 seconds to enter the menu.
4. Select Enroll MOK and press Enter.
5. Select View key 0 to inspect the certificate fingerprint and confirm it matches your generated key.
6. Select Continue, then choose Yes to confirm enrollment.
7. Type the temporary password created in Step 1.
8. Select Reboot to complete the process.

Upon loading back into your desktop or server shell, verify that the key is active by running mokutil --list-enrolled. Any signed kernel modules will now load seamlessly into the kernel.

How to Revoke or Delete a Key from the MOK Database

If an enrolled certificate expires, is superseded, or becomes compromised, you can schedule it for deletion:

1. Locate the target certificate file or export it directly from the database using:

   mokutil --export

   This command dumps all enrolled certificates as sequential files (such as MOK-0001.der) in your working directory.
2. Stage the certificate for revocation:

   sudo mokutil --delete MOK-0001.der

3. Enter and confirm a temporary validation password when prompted.
4. Reboot your system and access the blue MokManager console screen.
5. Select Delete MOK, confirm the key details, enter your temporary password, and reboot.

Disabling Secure Boot Validation for the Shim Layer

In development or diagnostic environments where testing unsigned binaries is temporarily necessary, but entering the motherboard UEFI BIOS setup is impractical, mokutil allows you to disable signature checking exclusively for the Linux Shim layer:

sudo mokutil --disable-validation

Set a temporary password, reboot, confirm the disable request in MokManager, and the Linux kernel will boot without rejecting unsigned modules while leaving motherboard UEFI Secure Boot enabled for other operating systems. Signature checking can be re-enabled at any time using sudo mokutil --enable-validation.

By leveraging mokutil and Machine Owner Key architecture, Linux administrators achieve the ideal balance between hardware-level firmware security and the operational flexibility required for custom drivers and kernel enhancements.