On 7/17/25 10:02 AM, Todd Zullinger wrote:
Tim via users wrote:
On Wed, 2025-07-16 at 13:39 -0400, Robert McBroom via users wrote:
My understanding was that it was a new password entry
Todd Zullinger's earlier post said:
You should already have the key, which is stored at
/etc/pki/akmods/certs/public_key.der. The "code" that
GNOME provides is the password for this key. Check that
the key exists and then proceed from the steps which start
after "Now you need to enroll the public key in MOK" in the
README.secureboot documentation.
You mentioned that code in your first post on this thread.
But I was wrong there. :)
I haven't used the automated setup of akmods on a system
with secureboot enabled, but I've done each separately.
In poking around a little, the generated key does not appear
to have a passphrase. That makes sense, since it is used in
automatic builds where there is no (consistent available)
way to prompt the user for it. The security of the key is
maintained only by file system permissions.
The password/code which is requested is just for MOK to
enroll the key. For context, the README.secureboot file
says this near the end:
Now you need to enroll the public key in MOK, this
process is described below.
- Ask MOK to enroll new keypair with certificate with the command
`mokutil --import /etc/pki/akmods/certs/public_key.der`.
- mokutil asks to generate a password to enroll the public key.
- Rebooting the system is needed for MOK to enroll the new public
key.
- On next boot MOK Management is launched and you have to choose
"Enroll MOK".
- Choose "Continue" to enroll the key or "View key 0" to show the
keys already enrolled.
- Confirm enrollment by selecting "Yes".
- You will be invited to enter the password generated above.
WARNING: keyboard is mapped to QWERTY!
- The new key is enrolled, and system ask you to reboot.
The drivers work for two other installed fedora systems but the new
system just goes to nouveau. Leary of doing something that would break
the working systems. Would think there would be a way to connect to
existing certificates.
--
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
