Where Are Secure Boot MOK Files Stored?
Where Linux keeps MOK key files for Secure Boot module signing, and how Ubuntu and Debian paths differ.
Last updated
Machine Owner Keys let local kernels and modules load under Secure Boot. Ubuntu generates its pair under the shim signed tree while Debian generates under the dkms tree. Enrollment happens once at the console with a one time password.
The private file signs modules while the public file enrolls into firmware. Losing the private half forces regeneration plus re enrollment everywhere. Include both files in system backups alongside the boot image. Kernel modules share the enrolled keys, so back up before firmware resets.
Where Machine Owner Keys stores this, by platform
/var/lib/shim-signed/mok/MOK.der
Ubuntu MOK home with public plus private files. Debian uses the dkms tree instead. Enroll once at the console, then back up both files.
Frequently asked questions
Should I back up my MOK files?
Copy the private plus public files from the paths in this post into scheduled backups. Firmware resets orphan enrolled keys and force full re enrollment. Restoring the files beats regenerating and re enrolling everything.
Ubuntu and Debian keep MOK files in different spots. Which is right?
Ubuntu generates under the shim signed tree while Debian generates under the dkms tree by default. Enrollment commands accept either path explicitly. Check both trees before assuming keys are missing.
Notice an outdated path? Let us know.