Secure boot and BootIt

[yottabytes2]

I have never used secure boot because it always gave me grief with Linux. But I see now that these latest genations of motherboards either requre secure boot or make it the default when you update the BIOS. IN addition, Linux Mint 22.3 request a "secure boot password" in order to download and install multimedia drivers during setup. What's the best practice when using BootIt to dual boot Linux and Windows and using secure boot? And does it make a difference where I should install the Linux boot files (Linux always wants to put them on my second physicial drive).

[Brian K]

yottabytes2,

I've "always" used Secure Boot. If it's not supported by a Linux distro, I don't use the distro.

I use Linux Mint 22.3 and I installed it without Multimedia drivers.

The Linux Bootloader files should go to the EFI system partition. I always choose that partition. I've tested all possible install sites and it doesn't matter what you choose as the files go to the EFI system partition anyway.

My BIU Mint Boot File is...

\EFI\ubuntu.001\shimx64.efi

This was created by the install.

You can install Windows and Mint on any drive. You can copy existing Windows and Mint to any drive.

[Brian K]

I just installed Mint 22.3 and used the Multimedia codecs choice. I used an 8 character password. In the early part of the setup the computer time is in UTC but at the end of the setup you are asked for a home city and the time changes to local. Total install time was 11 minutes.

On restart you are asked to remove the boot media and you see Continue Boot or Enrol MOK. I chose Enrol MOK. Then Continue, It asked for the password. I typed it but nothing was seen in the box field. Pressed Enter. Asked for Reboot. Mint booted. Chose Restart. Mint booted ok. I needed to reactivate BIU as Ubuntu was first in the Boot Option Priorities.
On subsequent Mint restarts there were no password requests.

Can you let me know which choices you made in the MOK setup?

[Brian K]

I installed another Mint 22.3 on the same SSD. (actually that makes 3 Mints on the SSD) Same method with codecs selected.
This time there was no mention of MOK. Mint booted and after several restarts there was still no mention of MOK.
The first MOK must be enough. I uninstalled this copy of Mint. I still have 2 Mints.

[yottabytes2]

Thanks for getting back to me. I tried to do a retrofit on my existing dual boot system. I entered maintenance and selected shimx64.efi. Linux booted fine with secure boot enabled. But the Nvidia drivers wouldn't load. When I re-installed them, Linuix would not boot. Le Chat tells me I need to run this command "sudo mokutil --import /var/lib/shim-signed/mok/MOK.der" to sign the Nvidia drivers. I will test on my next round of clean installing Windows and LInux. For now, I will leave well enought alone.