Can't boot Ubuntu 18.04.2 LTS or its LiveUSB after enrolling MOKDo I need to reinstall OS if changing motherboard?Can't boot Ubuntu 19.04 or its LiveUSB after enrolling MOKHow To Consolidate Multiple MOK Keys Or Delete Unnecessary Ones?Can't boot LiveUSB in Windows 8.1Mok Management Will Not Load on BootMOK manager utility won't show up on reboot on Ubuntu 16.04 (dual boot)Can't boot Ubuntu 19.04 or its LiveUSB after enrolling MOKLooking for a mokutil workaround to sign virtualbox kernel modules
Ultra-Relativistic and Non-Relativistic cases for energy of a particle
what would allow for the use of cannons but not handheld guns
Urgently need pre-paid debit card to pay debt collector
MobileDevice.pkg untrusted, cannot open Xcode after OS X update
How to create numeronyms in bash
What advantages do the absolute encoders gain by employing Gray code transmission instead of binary code?
Google Search Console is making up URLs which don't exist in my Sitemap and then complains that these pages have error
If I attempt to use the Teleport spell to teleport into an area warded by the Forbiddance spell, is my spell slot expended?
What other "Sections" are there in Starfleet?
Kitchen rewire gone wrong
Are snow shoes useful in mountaineering?
Busted my bike hub & derailleur (I think) - how bad is it?
Word or phrase for turning the tide against a rival in a competition in the last moments
When performing an Investigation check to look for traps, do you activate any traps if you roll under the DC?
Should I take a "positive, but not enthusiastically strong" letter of recommendation?
Approx 1948 Brasil Brazil Airliner...what is it? Taildragger?
What was the stated reason for giving Trump this award?
Does sleeping fewer hours than needed causes Common Cold?
How to call my own phone with a loud ringing tone (in order to find it in my house) even if it is in silent mode?
Regular expression grep -r 'emm*[a-f].[^ta]$'
What is the history of the Eldritch Knight as a class/character option?
Authentication versus Authorisation
Z80 CPU address lines not stable
What does "To die quietly of old age would be to go there on foot" mean?
Can't boot Ubuntu 18.04.2 LTS or its LiveUSB after enrolling MOK
Do I need to reinstall OS if changing motherboard?Can't boot Ubuntu 19.04 or its LiveUSB after enrolling MOKHow To Consolidate Multiple MOK Keys Or Delete Unnecessary Ones?Can't boot LiveUSB in Windows 8.1Mok Management Will Not Load on BootMOK manager utility won't show up on reboot on Ubuntu 16.04 (dual boot)Can't boot Ubuntu 19.04 or its LiveUSB after enrolling MOKLooking for a mokutil workaround to sign virtualbox kernel modules
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;
I'm unable to boot Ubuntu 18.04.2 LTS or its Live USB after enrolling MOK. Here are the steps that led to this situation.
- Clean install of Ubuntu 18.04.2 LTS on Dell Precision T7910 workstation. No other OS installed on this machine.
- The OS installed using a UEFI LiveUSB. Secure Boot ON.
- Installed nvidia-430 proprietary driver for an Nvidia Titan-X graphics card. Installation prompted me for a password to enroll with MOK. When rebooting, MOK Management screen asked for the password to enroll the key. I successfully enrolled the key. I've rebooted the system several times since. Everything worked fine.
- Had a motherboard failure. Replaced with a new motherboard. System booted fine after resetting the Dell Service Tag. Rebooted a couple of times with Secure Boot ON. No problems.
- Replaced the Nvidia graphics card with an AMD card. Default driver in Ubuntu worked fine. But I wanted to use the latest driver. Downloaded the driver from AMD website. Installation prompted me to set a password to enroll the key with MOK. Rebooted the machine. Enrolled the key with MOK using the same password. Upon rebooting, I'm now faced with the following error following which, the machine shuts off.
Unable to trigger tcg2 final events table: Invalid Parameter
Something has gone seriously wrong: import_mok_state() failed
: Invalid Parameter
Booting from Ubuntu's LiveUSB installer shows the same error message followed by machine shutdown. I get this error message regardless of whether Secure Boot is set to ON or OFF.
I can successfully boot the LiveUSB in legacy mode. But then I can't use the efibootmgr utility (see the 2nd answer here) to fix the loaders in the EFI partition. In order to use the efibootmgr utility, I need to boot in UEFI mode. But attempting to boot Ubuntu Live USB in UEFI mode results in the error message above and system shutdown.
I found another related thread here. However, since I can't boot from the LiveUSB in UEFI mode, I can't perform any EFI operations.
I was able to boot system rescue cd with Secure Boot ON. I deleted all partitions on the boot disk. Tried to reinstall Ubuntu from LiveUSB but faced with the same error message. I successfully installed Windows 10 which booted fine in secure mode. Next, I deleted all partitions again and decided to take a closer look at all the BIOS settings.
Turned on TPM. And now I can boot from the LiveUSB in Secure Boot mode. But if I turn off TPM, it reverts to the earlier error message. With TPM on, I reinstalled the OS from the LiveUSB. Chose to install additional video drivers which asked me to set a password for enrolling keys with Mok. Upon reboot, Mok Manager showed up and asked me for the password to enroll keys. I complied and now I can boot Ubuntu from the boot disk (as long as TPM is set to ON).
Questions:
- Why does TPM need to be ON for secure boot to work fine? It wasn't
ON the first time I installed ubuntu and secure boot was working fine. - Now that I am able to secure boot to the OS, are there things I could do to make secure boot work without TPM?
uefi secure-boot tpm
asked Jun 10 at 4:27
AC-DCAC-DC
516 bronze badges
add a comment
|
I'm unable to boot Ubuntu 18.04.2 LTS or its Live USB after enrolling MOK. Here are the steps that led to this situation.
- Clean install of Ubuntu 18.04.2 LTS on Dell Precision T7910 workstation. No other OS installed on this machine.
- The OS installed using a UEFI LiveUSB. Secure Boot ON.
- Installed nvidia-430 proprietary driver for an Nvidia Titan-X graphics card. Installation prompted me for a password to enroll with MOK. When rebooting, MOK Management screen asked for the password to enroll the key. I successfully enrolled the key. I've rebooted the system several times since. Everything worked fine.
- Had a motherboard failure. Replaced with a new motherboard. System booted fine after resetting the Dell Service Tag. Rebooted a couple of times with Secure Boot ON. No problems.
- Replaced the Nvidia graphics card with an AMD card. Default driver in Ubuntu worked fine. But I wanted to use the latest driver. Downloaded the driver from AMD website. Installation prompted me to set a password to enroll the key with MOK. Rebooted the machine. Enrolled the key with MOK using the same password. Upon rebooting, I'm now faced with the following error following which, the machine shuts off.
Unable to trigger tcg2 final events table: Invalid Parameter
Something has gone seriously wrong: import_mok_state() failed
: Invalid Parameter
Booting from Ubuntu's LiveUSB installer shows the same error message followed by machine shutdown. I get this error message regardless of whether Secure Boot is set to ON or OFF.
I can successfully boot the LiveUSB in legacy mode. But then I can't use the efibootmgr utility (see the 2nd answer here) to fix the loaders in the EFI partition. In order to use the efibootmgr utility, I need to boot in UEFI mode. But attempting to boot Ubuntu Live USB in UEFI mode results in the error message above and system shutdown.
I found another related thread here. However, since I can't boot from the LiveUSB in UEFI mode, I can't perform any EFI operations.
I was able to boot system rescue cd with Secure Boot ON. I deleted all partitions on the boot disk. Tried to reinstall Ubuntu from LiveUSB but faced with the same error message. I successfully installed Windows 10 which booted fine in secure mode. Next, I deleted all partitions again and decided to take a closer look at all the BIOS settings.
Turned on TPM. And now I can boot from the LiveUSB in Secure Boot mode. But if I turn off TPM, it reverts to the earlier error message. With TPM on, I reinstalled the OS from the LiveUSB. Chose to install additional video drivers which asked me to set a password for enrolling keys with Mok. Upon reboot, Mok Manager showed up and asked me for the password to enroll keys. I complied and now I can boot Ubuntu from the boot disk (as long as TPM is set to ON).
Questions:
- Why does TPM need to be ON for secure boot to work fine? It wasn't
ON the first time I installed ubuntu and secure boot was working fine. - Now that I am able to secure boot to the OS, are there things I could do to make secure boot work without TPM?
uefi secure-boot tpm
asked Jun 10 at 4:27
AC-DCAC-DC
516 bronze badges
you shouldn't have installed the driver from website. for both Nvidia and AMD the cleanest and most up-to-date way is through PPA. for future reference :sudo add-apt-repository ppa:oibaf/graphics-drivers -y && sudo apt-get updatethen open software and Updates and go to the drivers tab and install it.
– tatsu
Jun 10 at 7:45
Thanks @tatsu. I'll keep this in mind in the future. Any clue why my system now requires TPM to be ON in order to boot? With TPM OFF, regardless of whether Secure Boot is ON or OFF, I can neither boot from the boot disk nor from the LiveUSB; both generate the error message shown above.
– AC-DC
Jun 10 at 13:53
no unfortunately.
– tatsu
Jun 10 at 13:54
add a comment
|
I'm unable to boot Ubuntu 18.04.2 LTS or its Live USB after enrolling MOK. Here are the steps that led to this situation.
- Clean install of Ubuntu 18.04.2 LTS on Dell Precision T7910 workstation. No other OS installed on this machine.
- The OS installed using a UEFI LiveUSB. Secure Boot ON.
- Installed nvidia-430 proprietary driver for an Nvidia Titan-X graphics card. Installation prompted me for a password to enroll with MOK. When rebooting, MOK Management screen asked for the password to enroll the key. I successfully enrolled the key. I've rebooted the system several times since. Everything worked fine.
- Had a motherboard failure. Replaced with a new motherboard. System booted fine after resetting the Dell Service Tag. Rebooted a couple of times with Secure Boot ON. No problems.
- Replaced the Nvidia graphics card with an AMD card. Default driver in Ubuntu worked fine. But I wanted to use the latest driver. Downloaded the driver from AMD website. Installation prompted me to set a password to enroll the key with MOK. Rebooted the machine. Enrolled the key with MOK using the same password. Upon rebooting, I'm now faced with the following error following which, the machine shuts off.
Unable to trigger tcg2 final events table: Invalid Parameter
Something has gone seriously wrong: import_mok_state() failed
: Invalid Parameter
Booting from Ubuntu's LiveUSB installer shows the same error message followed by machine shutdown. I get this error message regardless of whether Secure Boot is set to ON or OFF.
I can successfully boot the LiveUSB in legacy mode. But then I can't use the efibootmgr utility (see the 2nd answer here) to fix the loaders in the EFI partition. In order to use the efibootmgr utility, I need to boot in UEFI mode. But attempting to boot Ubuntu Live USB in UEFI mode results in the error message above and system shutdown.
I found another related thread here. However, since I can't boot from the LiveUSB in UEFI mode, I can't perform any EFI operations.
I was able to boot system rescue cd with Secure Boot ON. I deleted all partitions on the boot disk. Tried to reinstall Ubuntu from LiveUSB but faced with the same error message. I successfully installed Windows 10 which booted fine in secure mode. Next, I deleted all partitions again and decided to take a closer look at all the BIOS settings.
Turned on TPM. And now I can boot from the LiveUSB in Secure Boot mode. But if I turn off TPM, it reverts to the earlier error message. With TPM on, I reinstalled the OS from the LiveUSB. Chose to install additional video drivers which asked me to set a password for enrolling keys with Mok. Upon reboot, Mok Manager showed up and asked me for the password to enroll keys. I complied and now I can boot Ubuntu from the boot disk (as long as TPM is set to ON).
Questions:
- Why does TPM need to be ON for secure boot to work fine? It wasn't
ON the first time I installed ubuntu and secure boot was working fine. - Now that I am able to secure boot to the OS, are there things I could do to make secure boot work without TPM?
uefi secure-boot tpm
asked Jun 10 at 4:27
AC-DCAC-DC
516 bronze badges
I'm unable to boot Ubuntu 18.04.2 LTS or its Live USB after enrolling MOK. Here are the steps that led to this situation.
- Clean install of Ubuntu 18.04.2 LTS on Dell Precision T7910 workstation. No other OS installed on this machine.
- The OS installed using a UEFI LiveUSB. Secure Boot ON.
- Installed nvidia-430 proprietary driver for an Nvidia Titan-X graphics card. Installation prompted me for a password to enroll with MOK. When rebooting, MOK Management screen asked for the password to enroll the key. I successfully enrolled the key. I've rebooted the system several times since. Everything worked fine.
- Had a motherboard failure. Replaced with a new motherboard. System booted fine after resetting the Dell Service Tag. Rebooted a couple of times with Secure Boot ON. No problems.
- Replaced the Nvidia graphics card with an AMD card. Default driver in Ubuntu worked fine. But I wanted to use the latest driver. Downloaded the driver from AMD website. Installation prompted me to set a password to enroll the key with MOK. Rebooted the machine. Enrolled the key with MOK using the same password. Upon rebooting, I'm now faced with the following error following which, the machine shuts off.
Unable to trigger tcg2 final events table: Invalid Parameter
Something has gone seriously wrong: import_mok_state() failed
: Invalid Parameter
Booting from Ubuntu's LiveUSB installer shows the same error message followed by machine shutdown. I get this error message regardless of whether Secure Boot is set to ON or OFF.
I can successfully boot the LiveUSB in legacy mode. But then I can't use the efibootmgr utility (see the 2nd answer here) to fix the loaders in the EFI partition. In order to use the efibootmgr utility, I need to boot in UEFI mode. But attempting to boot Ubuntu Live USB in UEFI mode results in the error message above and system shutdown.
I found another related thread here. However, since I can't boot from the LiveUSB in UEFI mode, I can't perform any EFI operations.
I was able to boot system rescue cd with Secure Boot ON. I deleted all partitions on the boot disk. Tried to reinstall Ubuntu from LiveUSB but faced with the same error message. I successfully installed Windows 10 which booted fine in secure mode. Next, I deleted all partitions again and decided to take a closer look at all the BIOS settings.
Turned on TPM. And now I can boot from the LiveUSB in Secure Boot mode. But if I turn off TPM, it reverts to the earlier error message. With TPM on, I reinstalled the OS from the LiveUSB. Chose to install additional video drivers which asked me to set a password for enrolling keys with Mok. Upon reboot, Mok Manager showed up and asked me for the password to enroll keys. I complied and now I can boot Ubuntu from the boot disk (as long as TPM is set to ON).
Questions:
- Why does TPM need to be ON for secure boot to work fine? It wasn't
ON the first time I installed ubuntu and secure boot was working fine. - Now that I am able to secure boot to the OS, are there things I could do to make secure boot work without TPM?
uefi secure-boot tpm
uefi secure-boot tpm
asked Jun 10 at 4:27
AC-DCAC-DC
516 bronze badges
asked Jun 10 at 4:27
AC-DCAC-DC
516 bronze badges
edited Jun 10 at 11:57
AC-DC
asked Jun 10 at 4:27
AC-DCAC-DC
516 bronze badges
asked Jun 10 at 4:27
AC-DCAC-DC
516 bronze badges
asked Jun 10 at 4:27
AC-DCAC-DC
516 bronze badges
516 bronze badges
you shouldn't have installed the driver from website. for both Nvidia and AMD the cleanest and most up-to-date way is through PPA. for future reference :sudo add-apt-repository ppa:oibaf/graphics-drivers -y && sudo apt-get updatethen open software and Updates and go to the drivers tab and install it.
– tatsu
Jun 10 at 7:45
Thanks @tatsu. I'll keep this in mind in the future. Any clue why my system now requires TPM to be ON in order to boot? With TPM OFF, regardless of whether Secure Boot is ON or OFF, I can neither boot from the boot disk nor from the LiveUSB; both generate the error message shown above.
– AC-DC
Jun 10 at 13:53
no unfortunately.
– tatsu
Jun 10 at 13:54
add a comment
|
you shouldn't have installed the driver from website. for both Nvidia and AMD the cleanest and most up-to-date way is through PPA. for future reference :sudo add-apt-repository ppa:oibaf/graphics-drivers -y && sudo apt-get updatethen open software and Updates and go to the drivers tab and install it.
– tatsu
Jun 10 at 7:45
Thanks @tatsu. I'll keep this in mind in the future. Any clue why my system now requires TPM to be ON in order to boot? With TPM OFF, regardless of whether Secure Boot is ON or OFF, I can neither boot from the boot disk nor from the LiveUSB; both generate the error message shown above.
– AC-DC
Jun 10 at 13:53
no unfortunately.
– tatsu
Jun 10 at 13:54
you shouldn't have installed the driver from website. for both Nvidia and AMD the cleanest and most up-to-date way is through PPA. for future reference :
sudo add-apt-repository ppa:oibaf/graphics-drivers -y && sudo apt-get update then open software and Updates and go to the drivers tab and install it.– tatsu
Jun 10 at 7:45
you shouldn't have installed the driver from website. for both Nvidia and AMD the cleanest and most up-to-date way is through PPA. for future reference :
sudo add-apt-repository ppa:oibaf/graphics-drivers -y && sudo apt-get update then open software and Updates and go to the drivers tab and install it.– tatsu
Jun 10 at 7:45
Thanks @tatsu. I'll keep this in mind in the future. Any clue why my system now requires TPM to be ON in order to boot? With TPM OFF, regardless of whether Secure Boot is ON or OFF, I can neither boot from the boot disk nor from the LiveUSB; both generate the error message shown above.
– AC-DC
Jun 10 at 13:53
Thanks @tatsu. I'll keep this in mind in the future. Any clue why my system now requires TPM to be ON in order to boot? With TPM OFF, regardless of whether Secure Boot is ON or OFF, I can neither boot from the boot disk nor from the LiveUSB; both generate the error message shown above.
– AC-DC
Jun 10 at 13:53
no unfortunately.
– tatsu
Jun 10 at 13:54
no unfortunately.
– tatsu
Jun 10 at 13:54
add a comment
|
1 Answer
1
active
oldest
votes
After a lot of searching, I found the following here:
The EUFI contains a database of registered trusted authorities. Users
can add their own trusted authorities to this database in order to
enable the loading of non-Microsoft operating systems.
This is where Trusted Platform Modules (TPMs) are used. TPMs can be
used to store keys, or perform encryption/signing/verification
routines. The TPM combined with the UEFI is what allows for the
verification of the boot loader, and the loading of an operating
system.
So it appears that proprietary Nvidia and AMD display drivers want to store their keys in the TPM.
TPM has two mode settings that are confusing - Active and Enabled. They mean different things. Active shows up as "TPM on" checkbox on my Dell Precision workstation. In this state, some functions of TPM are available. These include key storage and lookup. "Enabled" means that the TPM is fully functional; it can be used for things such as encrypting disks. This explains why TPM must be "on" or "active" for Ubuntu to boot (especially with proprietary display drivers) but it's not necessary to "enable" the TPM for Secure Boot.
With this understanding, I then used this article to remove old and unnecessary keys.
answered Jun 14 at 18:50
AC-DCAC-DC
516 bronze badges
add a comment
|
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1149920%2fcant-boot-ubuntu-18-04-2-lts-or-its-liveusb-after-enrolling-mok%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
After a lot of searching, I found the following here:
The EUFI contains a database of registered trusted authorities. Users
can add their own trusted authorities to this database in order to
enable the loading of non-Microsoft operating systems.
This is where Trusted Platform Modules (TPMs) are used. TPMs can be
used to store keys, or perform encryption/signing/verification
routines. The TPM combined with the UEFI is what allows for the
verification of the boot loader, and the loading of an operating
system.
So it appears that proprietary Nvidia and AMD display drivers want to store their keys in the TPM.
TPM has two mode settings that are confusing - Active and Enabled. They mean different things. Active shows up as "TPM on" checkbox on my Dell Precision workstation. In this state, some functions of TPM are available. These include key storage and lookup. "Enabled" means that the TPM is fully functional; it can be used for things such as encrypting disks. This explains why TPM must be "on" or "active" for Ubuntu to boot (especially with proprietary display drivers) but it's not necessary to "enable" the TPM for Secure Boot.
With this understanding, I then used this article to remove old and unnecessary keys.
answered Jun 14 at 18:50
AC-DCAC-DC
516 bronze badges
add a comment
|
After a lot of searching, I found the following here:
The EUFI contains a database of registered trusted authorities. Users
can add their own trusted authorities to this database in order to
enable the loading of non-Microsoft operating systems.
This is where Trusted Platform Modules (TPMs) are used. TPMs can be
used to store keys, or perform encryption/signing/verification
routines. The TPM combined with the UEFI is what allows for the
verification of the boot loader, and the loading of an operating
system.
So it appears that proprietary Nvidia and AMD display drivers want to store their keys in the TPM.
TPM has two mode settings that are confusing - Active and Enabled. They mean different things. Active shows up as "TPM on" checkbox on my Dell Precision workstation. In this state, some functions of TPM are available. These include key storage and lookup. "Enabled" means that the TPM is fully functional; it can be used for things such as encrypting disks. This explains why TPM must be "on" or "active" for Ubuntu to boot (especially with proprietary display drivers) but it's not necessary to "enable" the TPM for Secure Boot.
With this understanding, I then used this article to remove old and unnecessary keys.
answered Jun 14 at 18:50
AC-DCAC-DC
516 bronze badges
add a comment
|
After a lot of searching, I found the following here:
The EUFI contains a database of registered trusted authorities. Users
can add their own trusted authorities to this database in order to
enable the loading of non-Microsoft operating systems.
This is where Trusted Platform Modules (TPMs) are used. TPMs can be
used to store keys, or perform encryption/signing/verification
routines. The TPM combined with the UEFI is what allows for the
verification of the boot loader, and the loading of an operating
system.
So it appears that proprietary Nvidia and AMD display drivers want to store their keys in the TPM.
TPM has two mode settings that are confusing - Active and Enabled. They mean different things. Active shows up as "TPM on" checkbox on my Dell Precision workstation. In this state, some functions of TPM are available. These include key storage and lookup. "Enabled" means that the TPM is fully functional; it can be used for things such as encrypting disks. This explains why TPM must be "on" or "active" for Ubuntu to boot (especially with proprietary display drivers) but it's not necessary to "enable" the TPM for Secure Boot.
With this understanding, I then used this article to remove old and unnecessary keys.
answered Jun 14 at 18:50
AC-DCAC-DC
516 bronze badges
After a lot of searching, I found the following here:
The EUFI contains a database of registered trusted authorities. Users
can add their own trusted authorities to this database in order to
enable the loading of non-Microsoft operating systems.
This is where Trusted Platform Modules (TPMs) are used. TPMs can be
used to store keys, or perform encryption/signing/verification
routines. The TPM combined with the UEFI is what allows for the
verification of the boot loader, and the loading of an operating
system.
So it appears that proprietary Nvidia and AMD display drivers want to store their keys in the TPM.
TPM has two mode settings that are confusing - Active and Enabled. They mean different things. Active shows up as "TPM on" checkbox on my Dell Precision workstation. In this state, some functions of TPM are available. These include key storage and lookup. "Enabled" means that the TPM is fully functional; it can be used for things such as encrypting disks. This explains why TPM must be "on" or "active" for Ubuntu to boot (especially with proprietary display drivers) but it's not necessary to "enable" the TPM for Secure Boot.
With this understanding, I then used this article to remove old and unnecessary keys.
answered Jun 14 at 18:50
AC-DCAC-DC
516 bronze badges
answered Jun 14 at 18:50
AC-DCAC-DC
516 bronze badges
answered Jun 14 at 18:50
AC-DCAC-DC
516 bronze badges
answered Jun 14 at 18:50
AC-DCAC-DC
516 bronze badges
516 bronze badges
add a comment
|
add a comment
|
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1149920%2fcant-boot-ubuntu-18-04-2-lts-or-its-liveusb-after-enrolling-mok%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
you shouldn't have installed the driver from website. for both Nvidia and AMD the cleanest and most up-to-date way is through PPA. for future reference :
sudo add-apt-repository ppa:oibaf/graphics-drivers -y && sudo apt-get updatethen open software and Updates and go to the drivers tab and install it.– tatsu
Jun 10 at 7:45
Thanks @tatsu. I'll keep this in mind in the future. Any clue why my system now requires TPM to be ON in order to boot? With TPM OFF, regardless of whether Secure Boot is ON or OFF, I can neither boot from the boot disk nor from the LiveUSB; both generate the error message shown above.
– AC-DC
Jun 10 at 13:53
no unfortunately.
– tatsu
Jun 10 at 13:54