Error boot vmlinuz has invalid signature

https://github.com/jakeday/linux-surface/blob/master/SIGNING.md has more specific instructions on kernel signing (adapted from the same tutorial linked in the accepted answer). The instructions are reproduced in full as follows:

Signing a custom kernel for Secure Boot

Instructions are for ubuntu, but should work similar for other distros, if they are using shim
and grub as bootloader. If your distro is not using shim (e.g. Linux Foundation Preloader), there
should be similar steps to complete the signing (e.g. HashTool instead of MokUtil for LF Preloader)
or you can install shim to use instead. The ubuntu package for shim is called shim-signed, but
please inform yourself on how to install it correctly, so you do not mess up your bootloader.

Since the most recent GRUB2 update (2.02+dfsg1-5ubuntu1) in Ubuntu, GRUB2 does not load unsigned
kernels anymore, as long as Secure Boot is enabled. Users of Ubuntu 18.04 will be notified during
upgrade of the grub-efi package, that this kernel is not signed and the upgrade will abort.

Thus you have three options to solve this problem:

1. You sign the kernel yourself.
2. You use a signed, generic kernel of your distro.
3. You disable Secure Boot.

Since option two and three are not really viable, these are the steps to sign the kernel yourself.

Instructions adapted from the Ubuntu Blog.
Before following, please backup your /boot/EFI directory, so you can restore everything. Follow
these steps on your own risk.

1. Create the config to create the signing key, save as mokconfig.cnf:

# This definition stops the following lines failing if HOME isn't
# defined.
HOME                    = .
RANDFILE                = $ENV::HOME/.rnd 
[ req ]
distinguished_name      = req_distinguished_name
x509_extensions         = v3
string_mask             = utf8only
prompt                  = no

[ req_distinguished_name ]
countryName             = <YOURcountrycode>
stateOrProvinceName     = <YOURstate>
localityName            = <YOURcity>
0.organizationName      = <YOURorganization>
commonName              = Secure Boot Signing Key
emailAddress            = <YOURemail>

[ v3 ]
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer
basicConstraints        = critical,CA:FALSE
extendedKeyUsage        = codeSigning,1.3.6.1.4.1.311.10.3.6
nsComment               = "OpenSSL Generated Certificate"

Adjust all parts with <YOUR*> to your details.

1. Create the public and private key for signing the kernel:

openssl req -config ./mokconfig.cnf 
        -new -x509 -newkey rsa:2048 
        -nodes -days 36500 -outform DER 
        -keyout "MOK.priv" 
        -out "MOK.der"

1. Convert the key also to PEM format (mokutil needs DER, sbsign needs PEM):

openssl x509 -in MOK.der -inform DER -outform PEM -out MOK.pem

1. Enroll the key to your shim installation:

sudo mokutil --import MOK.der

You will be asked for a password, you will just use it to confirm your key selection in the
next step, so choose any.

1. Restart your system. You will encounter a blue screen of a tool called MOKManager.
   Select «Enroll MOK» and then «View key». Make sure it is your key you created in step 2.
   Afterwards continue the process and you must enter the password which you provided in
   step 4. Continue with booting your system.

Note: if MOKManger does not load on reboot then change the boot order. link

1. Verify your key is enrolled via:

sudo mokutil --list-enrolled

1. Sign your installed kernel (it should be at /boot/vmlinuz-[KERNEL-VERSION]-surface-linux-surface):

sudo sbsign --key MOK.priv --cert MOK.pem /boot/vmlinuz-[KERNEL-VERSION]-surface-linux-surface --output /boot/vmlinuz-[KERNEL-VERSION]-surface-linux-surface.signed

1. Copy the initram of the unsigned kernel, so we also have an initram for the signed one.

sudo cp /boot/initrd.img-[KERNEL-VERSION]-surface-linux-surface{,.signed}

1. Update your grub-config

sudo update-grub

1. Reboot your system and select the signed kernel. If booting works, you can remove the unsigned kernel:

sudo mv /boot/vmlinuz-[KERNEL-VERSION]-surface-linux-surface{.signed,}
sudo mv /boot/initrd.img-[KERNEL-VERSION]-surface-linux-surface{.signed,}
sudo update-grub

Now your system should run under a signed kernel and upgrading GRUB2 works again. If you want
to upgrade the custom kernel, you can sign the new version easily by following above steps
again from step seven on. Thus BACKUP the MOK-keys (MOK.der, MOK.pem, MOK.priv).

Страницы: [1] 2  Все   Вниз

0 Пользователей и 1 Гость просматривают эту тему.

Страницы: [1] 2  Все   Вверх

Как правильно задавать вопросы

Правильно сформулированный вопрос и его грамотное оформление способствует высокой вероятности получения достаточно содержательного и по существу ответа. Общая рекомендация по составлению тем: 1. Для начала воспользуйтесь поиском форума. 2. Укажите версию ОС вместе с разрядностью. Пример: LM 19.3 x64, LM Sarah x32 3. DE. Если вопрос касается двух, то через запятую. (xfce, KDE, cinnamon, mate) 4. Какое железо. (достаточно вывод inxi -Fxz в спойлере (как пользоваться спойлером смотрим здесь)) или же дать ссылку на hw-probe 5. Суть. Желательно с выводом консоли, логами. 6. Скрин. Просьба указывать 2, 3 и 4 независимо от того, имеет ли это отношение к вопросу или нет. Так же не забываем об общих правилах Как пример вот

Linux Mint Forums

Welcome to the Linux Mint forums!

Boot vmlinuz invalid signature — Secure Boot

Boot vmlinuz invalid signature — Secure Boot

Post by parupos » Fri Oct 02, 2020 11:38 am

My dual-boot system (Windows 10/ Linux Mint 20) lost boot from grub2 but was able to boot Windows fine, maybe the problem come out after running Update Manager which updated kernel 5.4.0-48 and mentioned secureboot-db and others. I have to recover linux mint 20 grub/boot, however when pick Linux boot fails with this message:
«error: /boot/vmlinuz-5.4.0-48-generic has invalid signature»
«error: you need to load the kernel first»

The last thing I remember before the above error was run update manager. No changes was made in BIOS. However a Windows 10 Update was done. I really don’t know the cause, so I appreciate any help.

Workaround for now: in BIOS disable Secure Boot, previously my Linux and Windows were booting normally with Secure Boot enabled.

Re: Boot vmlinuz invalid signature — Secure Boot

Post by Lord Boltar » Mon Oct 05, 2020 4:22 pm

Most likely your new kernel is not signed for secure boot — have a look here

IF your problem has been solved, please edit your original post and add [SOLVED] to the beginning of the Subject Line. It helps other members

The only way for evil to prosper is for good men to do nothing

Re: Boot vmlinuz invalid signature — Secure Boot

Post by parupos » Sun Oct 11, 2020 7:38 pm

The guide was followed up to step 5, Enrolled MOK, and asked for password, then booted the system,
however verifying if was enrolled,

sudo mokutil —list-enrolled

Got the output:
MokListRT is empty

Any idea or something to check?

Re: Boot vmlinuz invalid signature — Secure Boot

Post by Lord Boltar » Tue Oct 13, 2020 2:28 pm

Might want to have a look here

IF your problem has been solved, please edit your original post and add [SOLVED] to the beginning of the Subject Line. It helps other members

The only way for evil to prosper is for good men to do nothing

Re: Boot vmlinuz invalid signature — Secure Boot

Post by parupos » Thu Oct 29, 2020 10:54 am

Re: Boot vmlinuz invalid signature — Secure Boot

Post by Larry78723 » Thu Oct 29, 2020 11:04 am

Источник

Invalid signature for kernel #908

I am trying to dual boot Pop OS with Windows 10 and I have secure boot enabled. When I try to boot from a live USB i get the following error when I press «Try or Install Pop OS»
error: /casper_pop-os_19.10_amd_intel_debug_191/vmlinuz.efi has invalid signature
error: you need to load the kernel first

What am I doing wrong?

The text was updated successfully, but these errors were encountered:

I have the same issue

But i didn’t have to do the changes in grub.cfg it was already like that

and when booting and selecting any of the options i get the same error as @Vignesh-Nswamy

@bb4L Apparently secure boot should be turned off before booting Pop OS. Consequence of Secure Boot is that, it does not allow any bootloader not signed by Microsoft to run.

@Vignesh-Nswamy this means you got it running?

will try it out soon thanks for the hint!

I don’t wanna turn off secure boot. So I didn’t try. But there’s a way to sign the kernel so the boot loader can run without secure boot being turned off. Haven’t tried yet. Try with the LTS version. @bb4L

i tried with the LTS iso, same outcome.

how could you manually sign the kernel?

Secure Boot is recommended to be turn off. Actually, secure boot was developed for Window. In order to stay away problem and trouble, just close it.

Secure boot is not supported

will try it out soon thanks for the hint!

© 2023 GitHub, Inc.

You can’t perform that action at this time.

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.

Источник

Thread: vmlinuz has invalid signature

Thread Tools

Display

vmlinuz has invalid signature

I have two linux installed. Neither can boot the other, but I can boot each one separately. Here’s what I get:

/boot/vmlinuzxxxxx has invalid signature
you need to load kernel first

update-grub from either one’s grub and it builds the other, but fails on restart with the above message.

Much googling I found several answers. One of which suggests the other kernel needs to be signed. [example: sudo mokutil —import MOK.der]
I have an original hard drive that I loaded ubuntu, deepin, lubuntu without issue.

Secure Boot enabled.

Strange because this hard drive never had Windows or deepin. The efi partition was freshly installed along with two ext4 partitions?!

Re: vmlinuz has invalid signature

Try with Secure Boot off.
What brand/model system?

If not working then.
May be best to see details, use ppa version with your live installer or any working install, not older Boot-Repair ISO:
Please copy & paste link to the Boot-info summary report ( do not post report), the auto fix sometimes can create more issues.
https://help.ubuntu.com/community/Boot-Repair

Re: vmlinuz has invalid signature

I’d rather not have Secure Boot off. I did try with it though. Same result.

This gets stranger as times goes by. That hard drive above that contained Fedora. But it reappeared using ‘efibootmgr’ on the new hard drive. Acer BIOS has no mention of Fedora after the swap. [I removed the boot appearance using efibootmgr.] Not sure how it got there though.

Now with new hard drive I edited Ubuntu’s grub.cfg to a very small file so I could keep tabs on who boots what. From Acer BIOS I made Deepin 1st boot order, after which I did update-grub from Deepin.
After that and on reboot [Deepin now in control] boots all three linuxes: Deepin, Ubuntu, Lubuntu just fine. BUT it used Ubuntu’s grub.cfg file. The one I modified.

I’m new to efi. Used mbr since conception (around 1980). I don’t particularly like boot-repair because all the fixes happen between closed doors and I just get a printout. I like to know what took place and in what order.

I will fire up live and install the ppa version to see what’s what adn how it works.

Last edited by VMC; March 4th, 2019 at 07:31 AM .

Re: vmlinuz has invalid signature

If you know what you want to fix, often best not to run Boot-Repair auto-fix and then use its advanced options.
But you can run the report without running repairs.

With UEFI you should be using gpt.

All Acer have required UEFI updates, if an SSD firmware updates and the setting of «trust» from within UEFI.

Re: vmlinuz has invalid signature

I originally thought the errors where in there.

At any rate, it now works but I’m less informed. It started working after I booted deepin from Acer bios, and did a update-grub. That’s the confusing part. If sda belongs to ubuntu, why would deepin update matter.

I don’t have an ssd as of yet. Your efi-tips is a big help, and that friendly assassin has good info. thanks. repair-boot soon.

Re: vmlinuz has invalid signature

Each install puts boot files into the ESP — efi system partition (FAT32) in separate folders.

But Ubuntu and all its flavors and some based on Ubuntu only use /EFI/ubuntu. So I have multiple installs of Ubuntu and each overwrites the default /EFI/ubuntu folder. I have to reset it back to my main working install every time I do a test install. The configfile is just to start grub in the install in the partition referred to in the /EFI/ubuntu/grub.cfg (the 3 lines you posted). Some distributions embed the configfile and put more of the boot files normally in Ubuntu’s /boot folder and have those boot files in the ESP.

Which grub is in charge will depend on which you use or set as default in UEFI. UEFI’s ESP is somewhat like having multiple MBRs all one one drive. So you can choose from UEFI what system to boot.

I do not think it is Secure Boot that prevents you seeing your Ubuntu partition from Deepin. Do not know Deeping, but issue is often ownership (same user name or id as 1000) or permissions.

Источник

CentOS

The Community ENTerprise Operating System

Secure Boot issue: /vmlinuz has invalid signature

Secure Boot issue: /vmlinuz has invalid signature

Post by cuchumino » 2014/12/06 04:22:30

Hello All! New to the CentOS community and

I installed CentOS on my laptop a couple of hours ago. Am very happy so far with the distro, but I ran into one thing.

I noticed that the freshly installed CentOS with the 3.10 kernel, my logitech wireless mouse was not working.

I read on some threads in here, that installing kernel-ml from elrepo repository would fix the problem albeit through a newer kernel.

So I did just that. I also did as mentioned on the elrepo.org homepage, some steps to follow since I do have secure boot. The link for secure boot is here : http://elrepo.org/tiki/SecureBootKey

I did exactly as shown, and rebooted. Enrolled the MOK, and restarted.

Grub screen loads on boot. When I try to get into CentOS with the new kernel with secure boot running, I get the following message after hitting enter.

I turned off Secure Boot, and I am able to load using kernel 3.17. And yes. my wireless mouse does work with 3.17.

I know I am doing something wrong with the MOK, at that step.

During boot, I’ve stopped and UEFI booted through all the .efi files available in both EFI/Microsoft EFI/centos and EFI/boot. All have the same outcome through grub, except for the Microsoft one, where it boots into windows.

I am not sure if there is another .efi file somewhere that would allow loading the 3.17 kernel, that I should put in one of the EFI folders and run during UEFI boot.

I’m not sure how to collect logs at boot time, if that would be useful at all, although I don’t think it would be at the time.

I hope I’m making sense. Thanks!

EDIT: I didn’t make clear that I am currently booting into the system with Secure Boot off, but I’d like to have it on.

Источник

Thread: vmlinuz has invalid signature

Thread Tools

Display

vmlinuz has invalid signature

I have two linux installed. Neither can boot the other, but I can boot each one separately. Here’s what I get:

/boot/vmlinuzxxxxx has invalid signature
you need to load kernel first

update-grub from either one’s grub and it builds the other, but fails on restart with the above message.

Much googling I found several answers. One of which suggests the other kernel needs to be signed. [example: sudo mokutil —import MOK.der]
I have an original hard drive that I loaded ubuntu, deepin, lubuntu without issue.

Secure Boot enabled.

Strange because this hard drive never had Windows or deepin. The efi partition was freshly installed along with two ext4 partitions?!

Re: vmlinuz has invalid signature

Try with Secure Boot off.
What brand/model system?

If not working then.
May be best to see details, use ppa version with your live installer or any working install, not older Boot-Repair ISO:
Please copy & paste link to the Boot-info summary report ( do not post report), the auto fix sometimes can create more issues.
https://help.ubuntu.com/community/Boot-Repair

Re: vmlinuz has invalid signature

I’d rather not have Secure Boot off. I did try with it though. Same result.

This gets stranger as times goes by. That hard drive above that contained Fedora. But it reappeared using ‘efibootmgr’ on the new hard drive. Acer BIOS has no mention of Fedora after the swap. [I removed the boot appearance using efibootmgr.] Not sure how it got there though.

Now with new hard drive I edited Ubuntu’s grub.cfg to a very small file so I could keep tabs on who boots what. From Acer BIOS I made Deepin 1st boot order, after which I did update-grub from Deepin.
After that and on reboot [Deepin now in control] boots all three linuxes: Deepin, Ubuntu, Lubuntu just fine. BUT it used Ubuntu’s grub.cfg file. The one I modified.

I’m new to efi. Used mbr since conception (around 1980). I don’t particularly like boot-repair because all the fixes happen between closed doors and I just get a printout. I like to know what took place and in what order.

I will fire up live and install the ppa version to see what’s what adn how it works.

Last edited by VMC; March 4th, 2019 at 07:31 AM .

Re: vmlinuz has invalid signature

If you know what you want to fix, often best not to run Boot-Repair auto-fix and then use its advanced options.
But you can run the report without running repairs.

With UEFI you should be using gpt.

All Acer have required UEFI updates, if an SSD firmware updates and the setting of «trust» from within UEFI.

Re: vmlinuz has invalid signature

I originally thought the errors where in there.

At any rate, it now works but I’m less informed. It started working after I booted deepin from Acer bios, and did a update-grub. That’s the confusing part. If sda belongs to ubuntu, why would deepin update matter.

I don’t have an ssd as of yet. Your efi-tips is a big help, and that friendly assassin has good info. thanks. repair-boot soon.

Re: vmlinuz has invalid signature

Each install puts boot files into the ESP — efi system partition (FAT32) in separate folders.

But Ubuntu and all its flavors and some based on Ubuntu only use /EFI/ubuntu. So I have multiple installs of Ubuntu and each overwrites the default /EFI/ubuntu folder. I have to reset it back to my main working install every time I do a test install. The configfile is just to start grub in the install in the partition referred to in the /EFI/ubuntu/grub.cfg (the 3 lines you posted). Some distributions embed the configfile and put more of the boot files normally in Ubuntu’s /boot folder and have those boot files in the ESP.

Which grub is in charge will depend on which you use or set as default in UEFI. UEFI’s ESP is somewhat like having multiple MBRs all one one drive. So you can choose from UEFI what system to boot.

I do not think it is Secure Boot that prevents you seeing your Ubuntu partition from Deepin. Do not know Deeping, but issue is often ownership (same user name or id as 1000) or permissions.

Источник