Mokutil failed to enroll new keys (under root)

English Install/Boot/Login
1

Hi,

I try to get virtualbox running on my opensuse leap 15.5, with secure boot enabled. However, I encounter some problems with building the kernel modules:

The kernel modules built by /usr/sbin/vboxconfig are obviously signed by openSUSE Secure Boot CA, but my machine does not have this key enrolled.

mokutil --list-enrolled only prompts one single key, which is signed by CN=SUSE Linux Enterprise Secure Boot CA but not by openSUSE Secure Boot CA.

openSUSE-signkey-cert which includes the required key to be enrolled /etc/uefi/certs/1F673297-kmp.crt is already installed. However, altough using root privileges mokutil --import /usr/uefi/certs/1F673297-kmp.crt only yields the error message Failed to enroll new keys.

root:/etc/uefi/certs # mokutil --import 1F673297-kmp.crt
input password: 
input password again: 
Failed to enroll new keys

It seems to me that mokutilfails do most of its activities except for --list-enrolled and

root:~/ # mokutil --sb-state 
SecureBoot enabled

I would really appreciate some help about this weird issue, since almost all threads regarding the virtualbox installation with secure boot enabled deal with importing the right key via mokutil, which fails on my machine.

Thanks a lot in advance.

2

Maybe you can see in your UEFI/Bios which keys are supported?

There was something with HP laptop only using HP keys and must be switched to other keys ( I can not explain it more).

3

Thanks a lot for your quick and valuable support. Although it did not solve the specific issue of importing a key via mokutil (which still persists) it definitely solved my actual problem of getting virtualbox back alive.

The UEFI/BIOS settings indeed allowed only HP keys. Switching it to user defined keys obviously automatically loaded all pre-built virtualbox kernel modules after reboot.

So my issue here is closed.

Many thanks and a reverent bow

2 Likes