Where Does sbctl Store Secure Boot Keys?
sbctl Secure Boot keys and bundles on Linux, EFI variables plus local key database.
Last updated
sbctl manages custom Secure Boot keys on Linux with state in /var/lib/sbctl. Keys, owner GUIDs and signed bundles gather there. EFI variables mirror enrollment on the firmware side.
Backing up files alone never restores boot trust. Re enroll on the target board with the same keys. Keep the database and the firmware steps together.
Where sbctl stores this, by platform
/var/lib/sbctl/keys
Holds keys, GUIDs and bundles. Use sbctl status and sbctl verify for state. Never copy between machines without re enrolling.
Frequently asked questions
How do I back up sbctl keys?
Copy /var/lib/sbctl with the machine offline from live media. That holds keys, GUIDs and bundles. Re enroll after restore before rebooting into enforcement.
Where do I check sbctl enroll state?
Run sbctl status and verify Setup Mode. Enroll keys, sign bootloaders and kernels, then verify. Logs through the service unit show signing failures.
Notice an outdated path? Let us know.