[Doc improvement]: Secure Boot page incomplete for modern firmware behaviour

[SIDNut]

Official FAQ

• I have checked the official FAQ.

Ventoy Version

1.1.10

What about latest release

Yes. I have tried the latest release, but the bug still exist.

Try alternative boot mode

Yes. I have tried them, but the bug still exist.

BIOS Mode

UEFI Mode

Partition Style

GPT

Disk Capacity

64GB

Disk Manufacturer

No response

Image file checksum (if applicable)

None

Image file download link (if applicable)

No response

What happened?

Recommend updating https://www.ventoy.net/en/doc_secure.html

About Secure Boot in UEFI Mode

Secure Boot has been supported since Ventoy 1.0.07. An option for Secure Boot was added in Ventoy2Disk.exe / Ventoy2Disk.sh.

Menu: Option → Secure Boot Support (Ventoy2Disk.exe)
Command line: -s option (Ventoy2Disk.sh)

This option has been enabled by default since Ventoy 1.0.76.

When enabled, Ventoy uses a Microsoft-signed shim bootloader so that it can boot when Secure Boot is enabled. In normal operation, Ventoy should boot regardless of whether Secure Boot in the BIOS is enabled or disabled.

If Secure Boot is enabled in the BIOS, the following screen should normally appear the first time Ventoy boots. This is the MOKManager screen used to enroll the Ventoy key. Please follow the guide below.

---

Guide for Ventoy With Secure Boot in UEFI

1. The steps below only need to be completed once per computer when booting Ventoy for the first time.
2. Two enrollment methods are available: Enroll Key and Enroll Hash. Use whichever one you prefer.

Enroll Key

Enroll Hash

---

Known Issues and Workarounds

The Secure Boot solution may not work on some machines due to firmware configuration or Secure Boot policy restrictions. If you see an error screen instead of the blue MOKManager screen (for example Linpus Lite, Security Violation, or Security Policy Violation), use one of the workarounds below.

---

Case 1 – System Only Trusts the Windows UEFI CA

Some systems are configured to trust only the Windows UEFI CA. In this configuration the Microsoft 3rd-party UEFI CA is disabled. Since the Linux shim used by Ventoy is signed by the Microsoft 3rd-party CA, the firmware will refuse to boot Ventoy.

Typical symptoms:

• Ventoy USB does not boot
• Linpus Lite screen appears
• Secure Boot violation before the Ventoy menu

Solution

Enter the BIOS setup and enable the option that allows the Microsoft 3rd-party UEFI CA.

Example (Dell systems):

Enable Microsoft UEFI CA

After enabling this option, boot Ventoy again and the MOKManager screen should appear so the key can be enrolled.

If the computer will run Windows only, this option may be disabled again after Ventoy or Linux installation.

---

Case 2 – Firmware Blocks the shim → MOKManager Chain

On some systems the firmware may stop the boot process before MOKManager launches. This may occur on both newer systems and older systems that have received firmware updates.

Typical symptoms:

• Security Violation
• Security Policy Violation
• Ventoy starts but MOKManager does not appear

In this situation the firmware prevents the normal shim boot chain from launching the key enrollment program.

Solution

Boot MokManager directly and enroll the Ventoy key manually.

One-time USB Stick Preparation

1. Ensure Secure Boot Support was enabled when creating the Ventoy USB drive (enabled by default since Ventoy 1.0.76).
2. Place a copy of MokManager.efi in the Ventoy ISO directory.
   • You can download it from:
     https://github.com/ventoy/Ventoy/raw/refs/heads/master/INSTALL/EFI/BOOT/MokManager.efi
   • Or copy it from EFI/BOOT/ on the Ventoy EFI partition.

First Boot on a New Machine

1. Disable Secure Boot in the BIOS/UEFI firmware.
2. Boot the Ventoy USB drive.
3. From the Ventoy file list, select and boot MokManager.efi
   (Ventoy can boot EFI binaries directly).
4. Use Enroll Key to enroll the Ventoy key.
   The key file is located on the Ventoy EFI partition.
5. Reboot the system.
6. Re-enable Secure Boot in the BIOS/UEFI firmware.

After the key is enrolled, Ventoy should boot normally with Secure Boot enabled.

---

If none of the above solutions work, disable Ventoy Secure Boot Support and disable Secure Boot in BIOS before booting Ventoy.