Secure Boot is designed to prevent non-Windows OS from booting. However, you can still boot Grub2 with Secure Boot using Shim and MOK Manager. And from Grub2, you can boot into other operating systems.
- The shimx64.efi file included with AIO Boot is no longer valid. This article is only valid for AIO Boot NewGen version.
- VirtualBox version 7.0 has the option to enable Secure Boot. Tested with AIO Boot NewGen version, it works fine.
It does not work on all machines, and we can not chainload to .EFI files if it has not been signed (eg, rEFInd, Clover). You also need to perform additional steps on the MOK Manager. So the best way is to disable Secure Boot.
AIO Boot uses Shim (bootx64.efi is renamed from shimx64.efi) to boot at the first stage. Then Shim will load Grub2 (grubx64.efi) in the second stage. You can find lots of useful information about Secure Boot on Ubuntu and rEFInd.
If your computer does not have Secure Boot, you can boot from USB in VMware Workstation. Just enable UEFI mode and select Enable secure boot. Then boot Grub2 with Secure Boot using Shim and MOK Manager through the steps below.
Boot Grub2 with Secure Boot
You only need to do the steps below once.
The steps below are one of two ways, in step 3, Enroll key from disk should now be selected instead of Enroll hash from disk. The next steps choose the file /EFI/ENROLL_THIS_KEY_IN_MOKMANAGER.cer instead of the file grubx64.efi.
- You will see a blue screen with the following messages: ERROR – Verification failed: (15) Access Denied!. Press Enter to continue.
- In the Shim UEFI key management screen, press any key to perform MOK management.
- Perform MOK management: choose Enroll hash from disk, press Enter to continue.
- You will see the partitions in the next Select Binary screen. Select a partition of the AIO Boot, which contains the file /EFI/BOOT/grubx64.efi and /EFI/BOOT/bootx64.efi.
- Hit Enter and go to the path containing the file grubx64.efi. Select grubx64.efi in the list and press Enter to continue.
- [Enroll MOK]: Continue.
- Enroll the key(s)? Yes.
- Ok you will now return to the Perform MOK management screen in step 3.
- Select Reboot to reboot the system.
You can not load the module after booting into Grub2, error given:
error: Secure Boot forbids loading module from (hd1)/boot/grub. AIO Boot has embedded all necessary modules into grubx64.efi, these modules have been preloaded.
You can not chainload .EFI files that have not been signed. Clover and rEFInd have not been signed and it will not be able to boot from Grub2. Error given:
error: cannot load image.
You should disable Secure Boot so that AIO Boot can work as expected. Finally leave a comment to let me know that it works on your computer.