mokutil(1)
Manage UEFI Secure Boot keys and Machine Owner Key (MOK) settings.
Synopsis
mokutil [OPTION]...Description
mokutil is a utility for managing the Machine Owner Key (MOK) in UEFI firmware, which extends Secure Boot trust beyond manufacturer keys. It allows users to enroll, revoke, and list keys that control which kernels and modules can boot on their system.
Changes made with mokutil typically require reboot and confirmation via the MOK management screen (blue screen during boot). This tool is essential for systems running Secure Boot where you need to boot unsigned kernels or modules, such as custom kernels or out-of-tree drivers.
Common options
| Flag | What it does |
|---|---|
--list-enrolled | Display all currently enrolled MOK certificates |
--list-new | Show MOK certificates pending enrollment (awaiting reboot confirmation) |
--list-delete | List MOK certificates pending deletion |
--import <DER_FILE> | Enroll a new certificate from a DER file; requires password confirmation at next boot |
--delete <DER_FILE> | Remove a certificate from MOK list; requires reboot confirmation |
--revoke | Revoke the current MOK list and start fresh (interactive) |
--enable-validation | Enable UEFI Secure Boot validation |
--disable-validation | Disable UEFI Secure Boot validation without removing keys |
--sb-state | Display current Secure Boot state (enabled/disabled) |
--test-key | Check if a key is already enrolled in MOK |
--hash | Display SHA256 hash of a certificate file |
Examples
Check if Secure Boot is currently enabled or disabled on the system
mokutil --sb-stateShow all MOK certificates currently enrolled and trusted by the firmware
mokutil --list-enrolledQueue a new certificate for enrollment; you'll set a password and confirm at next boot
mokutil --import my-key.derCheck if a specific certificate is already enrolled in MOK without listing all keys
mokutil --test-key my-key.derRemove a certificate from MOK after confirming with a password at reboot
mokutil --delete old-key.derDisable Secure Boot validation while keeping MOK keys enrolled (requires reboot)
mokutil --disable-validationDisplay the SHA256 hash of a certificate to verify its identity
mokutil --hash my-cert.der