https://debiplobi.github.io/tags/secure-boot/Recent content in Secure-Boot on blogHugoen-usSun, 07 Jun 2026 22:34:31 +0530https://debiplobi.github.io/posts/easy-guide-to-secure-boot/Sun, 07 Jun 2026 22:34:31 +0530https://debiplobi.github.io/posts/easy-guide-to-secure-boot/<h2 id="why">Why?</h2> <p>Over the years I have found that doing dual booting with secureboot is a pain.</p> <p>There are many ways to do it but I have found easier way to do it with signing the firmware with own keys.</p> <p>So, We are gonna use tool called <code>sbctl</code> which does that for us.</p> <p>Remember, I am no expert on this and I am writing from my experience.</p> <h2 id="lets-start">Let&rsquo;s start</h2> <h3 id="install-the-required-package">Install the required package</h3> <ul> <li>Install <code>sbctl</code> as per your distro.</li> </ul> <h3 id="check-the-status">Check the status</h3> <pre tabindex="0"><code>$ sbctl status Installed: ✘ Sbctl is not installed Setup Mode: ✘ Enabled Secure Boot: ✘ Disabled </code></pre><ul> <li>You should see that sbctl is not installed and secure boot is disabled.</li> </ul> <h3 id="create-the-keys">Create the keys</h3> <pre tabindex="0"><code>$ sbctl create-keys </code></pre><h3 id="enroll-the-keys">Enroll the keys</h3> <pre tabindex="0"><code>sbctl enroll-keys --microsoft </code></pre><h3 id="sign-the-kernel-and-modules">Sign the kernel and modules</h3> <pre tabindex="0"><code>sbctl sign-all </code></pre><p>This command signs almost everything needed eg: kernel, bootloader, etc.</p>