Nvidia on Ubuntu/Kernel modules

I came across an issue on the Linux Surface project titled DKMS kernel modules give "Key was rejected by service" on Ubuntu 22.04 with 5.19.2 - which is exactly the same problem I'm witnessing with my DKMS modules on Ubuntu 24.

There is a lot of great detective work in the comments on that issue to help diagnose and debug the issue I'm having.

I modified /etc/dkms/framework.conf to specify the "existing" certs that were generated by DKMS on Ubuntu:

# mok_signing_key=/var/lib/dkms/mok.key
mok_signing_key="/var/lib/shim-signed/mok/MOK.priv"
# mok_certificate=/var/lib/dkms/mok.pub
mok_certificate="/var/lib/shim-signed/mok/MOK.der"

Then I issued an

sudo update-secureboot-policy --enroll-key

Which brings up the NCurses dialog box to supply a password for the Mokutil system

I gave it a (Secure Boot) password. (See Password safe.)

And rebooted

But video still didn't work.

But then I noticed that I inadvertently supplied the incorrect configuration by specifying MOK.der as the key (duplicating the key config). So checking for validity of the key, it seems the key got messed up so I probably need to regenerate it or delete it so the system generates a new one.

The Canonical key is enrolled.

mokutil --list-enrolled
[key 1]
SHA1 Fingerprint: 76:a0:92:06:58:00:bf:37:69:01:c3:72:cd:55:a9:0e:1f:de:d2:e0

mokutil --test-key /var/lib/shim-signed/mok/MOK.der
Not a valid x509 certificate

So, I deleted the bad public cert

rm /var/lib/shim-signed/mok/MOK.der

And deleted all the previous generated modules

rm -rf /var/lib/dkms/nvidia/

And purged all installed nvidia driver

apt-get remove -y --purge '^libnvidia-.*' && apt-get remove -y --purge '^nvidia-*' && apt-get remove -y --purge '*575*' && apt -y autoremove

And then rebooted (should regenerate MOK.der)

Machine Owner Key used in the UEFI for SecureBoot