Drivers and Secure Boot

Secure Boot

How it works

With Secure Boot on, your firmware only starts software signed by a key it trusts. RakuOS uses Fedora's shim and GRUB, which every PC trusts, and signs its own kernel with the RakuOS Secure Boot key. That key has to be added once to your firmware's list of extra keys (the MOK list). The installer queues it for you; you confirm it on the first boot.

Enrolling the key

If the blue MOK Manager screen appeared after installing and you finished it, you're done. Otherwise, or if you turn Secure Boot on later:

sudo rakuos enroll-secureboot-key

Then reboot. At the blue MOK Manager screen:

  1. Choose Enroll MOK (and Delete MOK too, if it's offered), then Continue.
  2. Confirm with Yes and type the password rakuos.
  3. Choose Reboot.

To turn Secure Boot on later: run the command above first, then enable Secure Boot in your firmware settings, and complete MOK Manager on that boot. With Secure Boot on, the RakuOS kernel only starts once its key is enrolled.

Cleaning up old keys

enroll-secureboot-key also removes unknown keys only. In practice those are keys that were made on a PC, not keys published by an operating system vendor:

  • the "RakuOS Machine Module Signing Key" that installs before October 2026 created (no longer used);
  • keys made by akmods or DKMS for self-built drivers, whether RakuOS or another distribution you used made them;
  • other signing keys someone made and enrolled themselves.

It leaves these alone:

  • the RakuOS key and Universal Blue's keys;
  • Microsoft's keys, so Windows and dual boot keep working;
  • keys from other Linux and BSD distributions, such as Fedora/Red Hat, CentOS, AlmaLinux, Rocky, Oracle, Ubuntu, Debian, SUSE/openSUSE, Proxmox, FreeBSD, NetBSD and OpenBSD.

The command only changes the MOK list. The firmware's own built-in Secure Boot keys, including Microsoft's, are never touched. It prints KEEP or Removing for each key, so you can see what it will do, and nothing is deleted until you choose Delete MOK at the next boot.

These keys live in your PC's firmware, not on the disk, so reformatting the drive doesn't remove them. A key you or a driver tool made on a distribution you used years ago can still be there.

Checking

mokutil --sb-state                                    # is Secure Boot on?
mokutil --list-enrolled | grep -E 'Subject|Issuer'    # which keys are enrolled

Please don't fix driver problems by turning Secure Boot off or by making and enrolling your own signing key: the key gets removed again, and anti-cheat checks for both. See Drivers instead.