When trying to boot Ubuntu with UEFI Secure Boot enabled, I get the following error when loading GRUB:
Boot failure : a proper digital signature was not found.
One of the files on the selected boot device was rejected by the Secure Boot feature.
Secure Boot works correctly when booting from a USB stick, both with Ubuntu 14.04.3 and with Ubuntu 16.04.
How can I begin troubleshooting this issue?
Further information
Relevant installed packages:
- fwupdate-signed 1.11+0.5-2ubuntu4
- grub-efi-amd64-signed 1.66+2.02~beta2-36ubuntu3
- linux-signed-generic 4.4.0.22.23
- shim-signed 1.12+0.8-0ubuntu2
Best Answer
The simple solution is to disable Secure Boot, as described on this page of mine. To be sure, it's better to run with Secure Boot enabled, but if the feature isn't working as designed, it's a liability.
For more thorough diagnostics, I recommend you start by examining your EFI boot entries by typing
sudo efibootmgr -v
, as in:Check the
BootOrder
line and examine each of the entires specified in order. For instance, in this example,0000
is first, andBoot0000
launches rEFInd. What you should examine in more detail is the file that's launched, such as\EFI\refind\refind_x64.efi
for this example'sBoot0000
. In the case of a standard Ubuntu Secure Boot launch, the file should beshimx64.efi
, which of course is not the case for this example'sBoot0000
-- but it is true for this example's next boot entry,Boot0003
.This example would probably produce a Secure Boot warning such as you describe on most computers, but after that warning, GRUB and Ubuntu might launch, since when
Boot0000
failed, the system would move on toBoot0003
, which should succeed. It's possible that something like this is happening to you -- but it's probably launchinggrubx64.efi
first, and then either failing to move on orshimx64.efi
might not have an entry. If this is the case for you, you could tweak the boot order with the-o
option toefibootmgr
or create a new entry entirely. The details depend on what you see fromefibootmgr -v
and what's actually installed on your hard disk, though.If your
efibootmgr -v
output shows that the computer should be launchingshimx64.efi
first, then I recommend you compare that file to theEFI/BOOT/bootx64.efi
file on the Ubuntu installation media that do boot. Check their file sizes withls -l
and check if they're identical withdiff
; for instance:(The mount points are likely to be different, of course.) These files should be identical, which
diff
indicates by providing no output. If they aren't, you could try overwriting theshimx64.efi
on the hard disk withbootx64.efi
from the installation medium. If the two files are not identical because of a package upgrade, that would be cause for filing a bug report. They might not be identical for some other reason, though, like disk corruption or a (very rare) error when copying files.If the files are identical but the external medium boots and the hard disk doesn't, then that probably means you've got a buggy EFI. You might look for an update on your manufacturer's Web site. (They probably call it a "BIOS update," although it's really not a BIOS.) If that doesn't help, you might try filing a bug report with the manufacturer.