quick-docs/modules/ROOT/pages/mok-enrollment.adoc

= Machine Owner Key Enrollment
Jiri Eischmann 
:revnumber: F40
:revdate: 2024-06-15
:category: Administration
:tags: How-to,   Nvidia

[abstract]
This page documents how to enroll a machine owner key that is created during the Nvidia driver installation (typically in GNOME Software).

== Prerequisite

The Nvidia driver has been installed and a machine owner key to self-sign the driver has been created in GNOME Software (or in a similar tool that supports it).

== Enrolling Self-signing Key after Reboot

In order to successfully reboot to Fedora Workstation after the Nvidia driver installation, you have to enroll the machine owner key you created during installation in GNOME Software. During rebooting you'll be presented with the mokutil tool, follow the below steps to enroll the key:

1. Press any key to continue.
image:mok-util-01.png[mok-util-01.png,title="Shim UEFI key management"]

2. Select *Enroll MOK*.
image:mok-util-02.png[mok-util-02.png,title="Perform MOK management"]

3. Select *Continue* to proceed to the enrollment.
image:mok-util-03.png[mok-util-03.png,title="Enroll MOK"]

4. Select *Yes* to enroll the key.
image:mok-util-04.png[mok-util-05.png,title="Enroll the key(s)?"]

5. Type the password you created for the key during installation.
image:mok-util-05.png[mok-util-06.png,title="mokutil start screen"]

6. Select *Reboot* to reboot into the OS with the Nvidia drivers enabled.
image:mok-util-06.png[mok-util-07.png,title="Enroll the key(s) - Password"]

== Security Implications

Note that the enrolled machine owner key will be used to sign any future updates to the module or any other module you will decide to install and they will be implicitly trusted. All future updates will happen transparently with no interaction and/or authorization. Therefore, it's recommended to delete the machine owner key when it's no longer needed.

== Deleting Machine Owner Key

To delete the machine owner key, perform the following command in the terminal:
+
[subs="quotes"]
----
$ *sudo mokutil --delete /etc/pki/akmods/certs/public_key.der*
----
Adding Machine Owner Key Enrollment page with pictures 2024-06-04 12:59:33 +00:00			`= Machine Owner Key Enrollment`
Update modules/ROOT/pages/mok-enrollment.adoc Added meta data 2024-06-15 07:36:34 +00:00			`Jiri Eischmann`
			`:revnumber: F40`
			`:revdate: 2024-06-15`
			`:category: Administration`
			`:tags: How-to, Nvidia`
Adding Machine Owner Key Enrollment page with pictures 2024-06-04 12:59:33 +00:00
Update modules/ROOT/pages/mok-enrollment.adoc Added meta data 2024-06-15 07:36:34 +00:00			`[abstract]`
Adding Machine Owner Key Enrollment page with pictures 2024-06-04 12:59:33 +00:00			`This page documents how to enroll a machine owner key that is created during the Nvidia driver installation (typically in GNOME Software).`

			`== Prerequisite`

			`The Nvidia driver has been installed and a machine owner key to self-sign the driver has been created in GNOME Software (or in a similar tool that supports it).`

			`== Enrolling Self-signing Key after Reboot`

			`In order to successfully reboot to Fedora Workstation after the Nvidia driver installation, you have to enroll the machine owner key you created during installation in GNOME Software. During rebooting you'll be presented with the mokutil tool, follow the below steps to enroll the key:`

			`1. Press any key to continue.`
			`image:mok-util-01.png[mok-util-01.png,title="Shim UEFI key management"]`

			`2. Select Enroll MOK.`
			`image:mok-util-02.png[mok-util-02.png,title="Perform MOK management"]`

			`3. Select Continue to proceed to the enrollment.`
			`image:mok-util-03.png[mok-util-03.png,title="Enroll MOK"]`

			`4. Select Yes to enroll the key.`
			`image:mok-util-04.png[mok-util-05.png,title="Enroll the key(s)?"]`

			`5. Type the password you created for the key during installation.`
			`image:mok-util-05.png[mok-util-06.png,title="mokutil start screen"]`

			`6. Select Reboot to reboot into the OS with the Nvidia drivers enabled.`
			`image:mok-util-06.png[mok-util-07.png,title="Enroll the key(s) - Password"]`
Adding information about security implications and key deletion to the MOK enrollment page 2024-07-15 14:30:14 +00:00
			`== Security Implications`

			`Note that the enrolled machine owner key will be used to sign any future updates to the module or any other module you will decide to install and they will be implicitly trusted. All future updates will happen transparently with no interaction and/or authorization. Therefore, it's recommended to delete the machine owner key when it's no longer needed.`

			`== Deleting Machine Owner Key`

			`To delete the machine owner key, perform the following command in the terminal:`
			`+`
			`[subs="quotes"]`
			`----`
			`$ sudo mokutil --delete /etc/pki/akmods/certs/public_key.der`
			`----`