Loading out-of-tree custom Linux kernel modules (.ko) on UEFI Secure Boot enabled Ubuntu systems requires signing modules with a Machine Owner Key (MOK).

MOK Key Generation & Module Signing Commands

Terminal Commandsbash
# 1. Generate custom X.509 MOK key pair
openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 3650 -subj "/CN=Lynxbee Kernel Module Signing/"
 
# 2. Enroll public MOK key into UEFI firmware keyring
sudo mokutil --import MOK.der
 
# 3. Sign compiled kernel module binary using sign-file utility
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 MOK.priv MOK.der mydriver.ko