Secure Boot won't work on Ubuntu 24.04.2 shows 'invalid key' EQi12

Beelink CS-Bony

Keny
Thank you for your reply.

Please follow the following steps:

Step 1: Built-in BIOS Recovery

Restart and press Del to enter BIOS.
Security → Secure Boot Mode = Custom
Select “Restore Factory Keys” → Yes
Select “Reset To Setup Mode” → Yes
Press F10 to save and exit
Re-enter BIOS → Change Secure Boot Mode back to Standard
Keep Secure Boot Enabled → Press F10 to save and restart

Step 2: Verification on Ubuntu side
Run “sudo mokutil –sb-state” # It should return “SecureBoot enabled”
Run “sudo mokutil –list-enrolled” # It should show 5 or more keys
Run “dmesg | grep -i secure” # The boot log should not contain “invalid key”

Keny

Hi Beelink CS-Bony

Event tho when i run “sudo dmesg | grep -i secure”, i shows

[ 0.000000] secureboot: Secure boot enabled
[ 0.004829] secureboot: Secure boot enabled

But Ubuntu still shows invalid key exists.

Keny

Hi again @Beelink CS-Bony ,

I did some digging and this is what i found.

I ran:

mokutil --pk

and found that the Platform Key is:

Subject: CN=DO NOT TRUST - AMI Test PK
Issuer: CN=DO NOT TRUST - AMI Test PK

SHA1:
65:92:a5:06:36:fa:f8:be:9a:e7:4f:0f:7f:8b:d7:44:fa:44:b3:29

Valid:
Nov 8 2017 - Nov 8 2021

I also ran:

mokutil --kek

and found:

Microsoft Corporation KEK 2K CA 2023
Microsoft Corporation KEK CA 2011

So the 2023 Microsoft KEK is present.

Finally, fwupdmgr security reports:

UEFI secure boot: Enabled
UEFI platform key: Invalid
UEFI db: Not found

I also tried restoring the factory/default Secure Boot keys from the BIOS, but the same AMI Test PK remains.

Is this a known issue that your R&D team knows about? are they going to fix it?

Beelink CS-Bony

Keny
Sorry, please check the other reply to your forum post.
Our colleague has already responded to you.

« Previous Page