🔐Secure Boot Signing Chain Explained: Shim, MOK, and Custom Keys for Linux

Your custom Linux kernel won't boot without this

Secure Boot is only as good as the chain behind it, and Linux's chain runs through Microsoft. Your BIOS ships with Microsoft's UEFI CA 2011 key, Microsoft signs third-party shims, and the shim borrows that trust to boot GRUB and your kernel. Break any link and the machine stops. If you build your own kernel or ISO, this is your problem. The shim-signed package signs the shim, but GRUB and the kernel still need your own signatures. Sign GRUB with an unrecognized key and the shim drops you into MOK, the Master Of Keys enrollment screen, where you pick the key that matches your GRUB and Linux signatures. The mechanics are concrete. Generate keys with openssl req -newkey rsa:4096, sign the kernel with sbsign --key, and rename the EFI binary to grubx64.efi before signing it. Check shim signing with sbverify --list. Live USBs can't sign the kernel unless you build it manually, and Arch's archiso hook at airootfs/etc/pacman.d/hooks/zzzz98-mok-signing.hook handles signing at build time.