Skip to content

Secure Boot

Jump to bottom
Luke Horwell edited this page Oct 22, 2025 · 5 revisions

Many computers today are based on UEFI, a successor to BIOS. Typically Secure Boot is enabled by default, which prevents unsigned drivers from loading.

Since OpenRazer is an out-of-tree driver in the form of source code, the module is built locally for your kernel during installation (and repeats again when the kernel is upgraded). For most distros, this performed by by DKMS. Some distros and older installations don't have a mechanism to automatically sign that binary, so the kernel refuses to load OpenRazer when secure boot is enabled.

We have instructions for these distros:

See Further Reading for other distros.

Note: If you dual boot with Windows that uses a encrypted BitLocker partition, you may need the recovery key if you tamper or disable secure boot.

Current Status

The mokutil command can tell you the current status of secure boot.

You may need to install the package. e.g. in Debian/Ubuntu using sudo apt install mokutil or on Arch Linux: sudo pacman -S mokutil

sudo mokutil --sb-state

Ubuntu 24.04+

Assuming a typical installation with secure boot enabled:

sudo add-apt-repository ppa:openrazer/stable
sudo apt update
sudo apt install openrazer-meta

You may see a screen like the following. If you installed OpenRazer before enabling secure boot, you can still get to this screen:

Description Screenshot
A dialog will prompt about requiring additional configuration. If this does not appear automatically, try running: sudo update-secureboot-policy --enroll-key (If this doesn't work either, try sudo update-secureboot-policy --new-key first) Secure boot prompt
Set a password that's 8-16 characters long. Keep a note of it as you may need it again if you install additional third party modules. The next screen will confirm this password a second time. Secure boot password input
Installation will complete. Now's a good opportunity to add your user to the plugdev group. apt install completed
Reboot the computer. Your UEFI should prompt you about MOK enrolment (or similar). This screen may vary based on the manufacturer of your computer. On this system, it looks like this. MOK enrolment
Enter the password entered earlier and reboot. MOK password input
To confirm OpenRazer is working, it should be listed in the lsmod command. Ubuntu with lsmod command

Fedora 38+

Before following the Fedora instructions to install OpenRazer: You should set up akmods (Fedora's alternative to dkms).

  1. Install the auto signing tools:

    sudo dnf install kmodtool akmods mokutil openssl

  2. Generate your MOK key and certificate (Option A will tell kmodgenca to do nothing if you've already done this before)

    sudo kmodgenca -a

  3. Initiate the pub-key enrollment into UEFI:

    sudo mokutil --import /etc/pki/akmods/certs/public_key.der

    Enter a password, this only needs to be entered in the next step after rebooting.

  4. Reboot to MOK enrollment.

    sudo reboot

Now your signing key is in the list of trusted keys that may sign kernel modules. akmods is now already signing kernel modules so that other modules (like VirtualBox) will also work with secure boot.

Last step: Tell dkms about your signing keys.

  1. Make a new drop-in directory for dkms config files so your changes will not get accidentally overridden by dkms updates:

    sudo mkdir /etc/dkms/framework.conf.d
sudo touch /etc/dkms/framework.conf.d/sign-kernel-modules.conf

  2. Using your favourite editor add the following lines to this file:

    mok_signing_key=/etc/pki/akmods/private/private_key.priv
mok_certificate=/etc/pki/akmods/certs/public_key.der

Now you're all set to have dkms sign your kernel modules in order to get them to loaded with secure boot enabled.

Why can't OpenRazer do this?

OpenRazer can't sign the module as we are not distributing a kernel or binary. The "trust" comes from you and your motherboard. Installation mediums and default bootloaders are typically signed with a key that is universally trusted from the factory (typically a Microsoft key), although some distros (such as Arch Linux) do not have signed installation mediums and need secure boot disabled anyway.

Further reading

This wiki guide just covers Ubuntu. For other distributions, please see their wiki's, forums or use a search engine for guidance.

Clone this wiki locally