#1064807 nvidia-driver: cannot load nvidia driver with secure boot enabled (key was rejected by service)

#1064807#5
Date:
2024-02-26 04:58:40 UTC
From:
To:
modprobe: ERROR: could not insert 'nvidia_current': Key was rejected by
service
modprobe: ERROR: ../libkmod-module.c:1084 command_do() Errror running
install command 'modprobe -i nvidia-current ' for module nvidia: retcode 1
modprobe: ERROR: could not insert 'nvidia': Invalid argument


I enabled the UEFI Secure Boot and then the nvidia-driver did not load.
I tried to sign the kernel modules and the Linux kernel itself, also
tried to reinstall the nvidia-driver package with Secure Boot enabled,
but nothing worked and the error message remain the same.

I followed the instructions from here
(https://wiki.debian.org/SecureBoot#MOK_-_Machine_Owner_Key) and tried
to run:
$ modprobe nvidia
after reboot.

There are no extra configuration at all with nvidia-driver, I am using
the default installation that comes after installing nvidia-driver from APT.

The driver only works with Secure Boot disabled.

Unfortunately, the first three lines in this bug report is everything
that 'journalctl -xe', 'systemctl' and 'modprobe' returned about this
problem.  I had to disable Secure Boot to make this bug report.

#1064807#10
Date:
2024-02-26 05:59:10 UTC
From:
To:
I've replaced the user generated MOK keys and instead I just switched to
Debian's default keys, then just purged and reinstalled nvidia-driver in
order to make DKMS build the modules with the key and then it worked.

#1064807#15
Date:
2024-02-26 06:02:18 UTC
From:
To:
After trying and failing, I just gave up and reconfigured everything to
use Debian's MOK keys instead, then purged and installed the
nvidia-driver via APT again with Secure Boot enabled to make DKMS use
the new MOK keys and it worked.

Sorry for the inconvenience.

#1064807#20
Date:
2024-02-26 09:53:26 UTC
From:
To:
Did you use a key protected by a passphrase?

It's currently not well documented how to pass the passphrase to dkms
s.t. the modules get properly signed.


Andreas