Grub fails with active Secure Boot after BIOS update

[BierPizzaChips]

I upgraded my CPU from a Ryzen 5 3600 to a Ryzen 5 5700X.
The motherboard is a MSI B450M MORTAR TITANIUM (MS-7B89), that’s a Zen3.

The BIOS was updated from MSI E7B89AMS.AI1 to MSI E7B89AMS.AHO for supporting the new CPU according to MSI’s recommendations.

Interestingly Linux fails to boot with a grub failure if Secure Boot is active in the new BIOS (Secure Boot worked fine in the old BIOS).

There is a bunch of options for ‘Custom’ Secure Boot in that new BIOS like importing new keys, but i got nothing done with that.

I also used YaST with Bootloader for re-writing the Boot (got rid of Microsoft this way and will use the Windows partitions soon for something more helpful). But still failing with the new BIOS’s Secure Boot.

Anybody having any idea or suggestions of where i should look and configure for having my Linux launching again with Secure Boot?

[arvidjaar]

@BierPizzaChips

Anybody having any idea or suggestions of where i should look

Start with showing the actual errors.

[jsmith64]

I’ve never used Secure Boot and it’s not secure.
Your best best is don’t use it if you don’t have to.

But ArchWiki has a lot of good information on a lot of things.

Unified Extensible Firmware Interface/Secure Boot

Does it boot with Secure Boot off?

Also, I’m just like you. It doesn’t matter if it boots with Secure Boot off, I would want to know why Secure Boot doesn’t work now. I think Secure Boot sees the new BIOS update as an attack and you’re not using Windows to fix the keys.

[BierPizzaChips]

As requested:

[BierPizzaChips]

Yeah, there is something about importing keys in that new BIOS. I played a bit with that, but have no idea, what I am doing, so I failed.

Currently the Suse Bootloader has Secure Boot ticked. Shall I re-write the Bootloader without that tick?

[jsmith64]

Yes, that should fix it if you turn off Secure boot.

If you read the ArchWiki you can probably figure out why it isn’t booting with Secure Boot. I’m pretty sure it’s because there’s no key now.

[arvidjaar]

Boot Linux, show output of

efibootmgr -v

[BierPizzaChips]

As requested:

[arvidjaar]

Try selecting opensuse-secureboot in your BIOS boot menu.

[BierPizzaChips]

Thanks, arvidjaar. Appreciated.

There is no such option in my BIOS in the Secure Boot section.
And in the Boot section in “Fixed Boot Order Priorities” neither - at first.

But one below in the Boot section is the topic “UEFI Hard Disk Drive BBS Priorities”. Here i found in a sub-menu the option (I clicked on the first displayed option, which opened that sub-menu) ‘opensuse-secureboot’ and pushed it to become the first option in that Priorities menu.

Having done so, the option ‘opensuse-secureboot’ became selectable in “Fixed Boot Order Priorites”, where i placed it as highest priority.

Now back to the Secure Boot menu. I enabled Secure Boot with the subßoption ‘Standard’.

Result: My Linux is booting fine now. No more Grub issues. Fixed!

Many thanks again to arvidjaar, who pointed me into the right direction.