Secure Boot is designed to prevent non-Windows OS from booting. However, you can still boot Grub2 with Secure Boot using Shim and MOK Manager. And from Grub2, you can boot into other operating systems.

• Introduction
• Boot Grub2 with Secure Boot
• Limitation

Introduction

My computer does not have Secure Boot, I have not been able to test this feature in a while. Although the AIO Boot theory supports booting Grub2 with Secure Boot using Shim and MOK Manager, I have never tried it. But some users have confirmed that it works, Steve Si (author of Easy2Boot) wrote an article here. With VMware Workstation 14, I was able to try and it really works as expected.

It does not work on all machines, and we can not chainload to .EFI files if it has not been signed (eg, rEFInd, Clover). You also need to perform additional steps on the MOK Manager. So the best way is to disable Secure Boot.

AIO Boot uses Shim (bootx64.efi is renamed from shimx64.efi) to boot at the first stage. Then Shim will load Grub2 (grubx64.efi) in the second stage. You can find lots of useful information about Secure Boot on Ubuntu and rEFInd.

If your computer does not have Secure Boot, you can boot from USB in VMware Workstation. Just enable UEFI mode and select Enable secure boot. Then boot Grub2 with Secure Boot using Shim and MOK Manager through the steps below.

Boot Grub2 with Secure Boot

You only need to do the steps below once.

1. You will see a blue screen with the following messages: ERROR – Verification failed: (15) Access Denied!. Press Enter to continue.
   
2. In the Shim UEFI key management screen, press any key to perform MOK management.
   
3. Perform MOK management: choose Enroll hash from disk, press Enter to continue.
   
4. You will see the partitions in the next Select Binary screen. Select a partition of the AIO Boot, which contains the file /EFI/BOOT/grubx64.efi and /EFI/BOOT/bootx64.efi.
   
5. Hit Enter and go to the path containing the file grubx64.efi. Select grubx64.efi in the list and press Enter to continue.
   
6. [Enroll MOK]: Continue.
   
7. Enroll the key(s)? Yes.
   
   
8. Ok you will now return to the Perform MOK management screen in step 3. Repeat steps 3 through 7 again. But you need to select bootx64.efi in step 5 instead of grubx64.efi. This means that we will “enroll” both grubx64.efi and bootx64.efi.
9. After “enroll” for both grubx64.efi and bootx64.efi files. Select Continue boot to boot into Grub2. If you see the VMware Boot Manager screen, select Reset the system to reboot.
   

Limitation

You can not load the module after booting into Grub2, error given: error: Secure Boot forbids loading module from (hd1)/boot/grub. AIO Boot has embedded all necessary modules into grubx64.efi, these modules have been preloaded.

You can not chainload .EFI files that have not been signed. Clover and rEFInd have not been signed and it will not be able to boot from Grub2. Error given: error: cannot load image. And this also happened to Microsoft’s .EFI files, specifically booting into WinPE on the AIO Boot DVD.

You should disable Secure Boot so that AIO Boot can work as expected. Finally leave a comment to let me know that it works on your computer.