No UEFI secureboot after putting SSD from old into new machine

English Install/Boot/Login
1

Hi all,

I’ve read all matches for searching “UEFI secureboot”. Some of them stone age old :slight_smile: All of them similar to my issue “but” …

Old barebone, Leap 15.6 (upgraded from 42.x in a row, even the SSD was cloned from smaller ones. in history…). From beginning always booting via UEFI.

Got a new barebone, AMI BIOS.
Put my existing SSD into it.
Detected correctly, boot option found by BIOS is opensuse-secureboot....

1st try:

  • BIOS set to “secureboot=Y”, didn’t boot, popup error from BIOS:
Invalid signature detected. Check Secure Boot Policy in Setup.....

2nd try:
BIOS set to “secureboot=N”, didn’t boot, absolutely NO ERROR, no grub-rescue or whatever, nothing.

Flashed Leap 15.6 LIVE on an USB strick.
Booted with it, “rescue system” style.

Added via efibootmgr an additional NON-secure boot option:

sudo efibootmgr --create \
  --disk /dev/sda --part 1 \
  --label "opensuse-nonsecure" \
  --loader '\EFI\opensuse\grubx64.efi'

Which sudo efibootmgr -v lists correctly.

From then on the new AMI Bios started to “fight” against me :slight_smile:
Took me a while, but summarized:

  • As long, as \EFI\opensuse\shim.efiEXISTS on SSD, BIOS doesn’t give a damn on ANY efibootmanager created BootOptions!
  • If deleted, BIOS recreates the opensuse-secureboot entry, refering to
    shim.efi!
  • NO chance to even select the manually added opensuse-nonsecureoption, not even shown in BIOS!
  • Means, as described above, no boot possible.

Then, now knowing about the “summarized” findings, I’ve “brutally” moved shim.efi to shim.SAV, reapplied the create "opensuse-nonsecure" described above, set BIOS to “secureboot=N”, et voila, I can boot, unsecure.

As said searching here in forum, also asking “Aunt chatGPT”, AFAI understood in general it SHOULD work, as OpenSuse contains correctly signed kernel etc., so NO IDEA how to enable secureboot (again). Which Invalid signatures could be ment, how do I check them?

Any hints are highly appreciated!

Thanks, Michael

2
  1. Besides page long description post photo of the actual error.
  2. Post the full output of
mokutil --pk
mokutil --kek
mokutil --db
mokutil --dbx
3

This already written

Invalid signature detected. Check Secure Boot Policy in Setup.....

is the only “actual error” I’m getting. “Photo”, why :slight_smile: → Red square with EXACTLY the mentioned text, “…” abbreviates the not typed text “Press OK to reboot”

Pasted here.

4

As you wish. Still, you may try openSUSE:UEFI - openSUSE Wiki

5

@arvidjaar as you are always very, very helpful here, thank you again for that, I didn’t want to be inpolite, in any case!
So, as you asked, this is the photo.

nsmail
nsmail1920×853 76.2 KB

(Still not sure why this might be more helpful than what I’ve written about the error msg before :wink: )

Read through it.
Found some variances to my system, e.g.:

openSUSE:UEFI says:
To determine whether a machine has secure boot enabled in the firmware enter the following command as root in a Linux shell: # od -An -t u1 /sys/firmware/efi/vars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c/data
but