Safely deleteing X.509 certs created by repository Nvidia drivers?

English Install/Boot/Login
1

Hello,
I’m currently changing things around on my laptop due to issues with Nvidia drivers and I have re-installed nvidia-gfxG05 and 04 several times. Right now, I have a clutter of X.509 certificates

**#** dmesg |grep -i nvidia
    3.004959] integrity: Loaded X.509 cert 'Local build for **nvidia**-gfxG05 450.57 on 2020-08-21: 4c30bc67e45493356ad662f089bf0b76682f3aed'
    3.005097] integrity: Loaded X.509 cert 'Local build for **nvidia**-gfxG05 450.57 on 2020-08-22: 70c27eb629f4c11db82de20a93d12275fd96b738'
    3.005227] integrity: Loaded X.509 cert 'Local build for **nvidia**-gfxG05 450.66 on 2020-09-05: 756e0efa71dae9c4f8a3a9373f9c58b5060f9c82'
    3.005368] integrity: Loaded X.509 cert 'Local build for **nvidia**-gfxG05 450.66 on 2020-09-05: bd840cc514e837ef34e0e460fe3c5d4de91374d6'
    3.005494] integrity: Loaded X.509 cert 'Local build for **nvidia**-gfxG05 450.66 on 2020-09-07: 7a3be83f7b8b412871fc36d70697b64efba94d73'
    3.005623] integrity: Loaded X.509 cert 'Local build for **nvidia**-gfxG05 450.66 on 2020-09-07: ff49c54f584d1cf1d5607d8d14880cd2ff791464'

What’s a safe way to delete some of these?

Thanks.

2

If you have original certificate that has been enrolled you can use “mokutil --delete”. Otherwise I am afraid the only way is to clear full list using mokutil.

3

Before I try that, if I delete using mokutil and cannot boot, I should be able to boot with secureboot disabled and use mokutil to enroll new certificates right?

4

You can use “mokutil --export” to get the certificates. Then you have to work out which is which. The exported certificates are numbered with the same numbering as output from “mokutil -l”.