[Post-Install] secure boot

[Larry M]

If i installed Kubuntu with secure boot disabled, will switching it on work as intended?

[Qqmike]

You still there? No one chimed in yet.

I've never tried it. I can at least give you something to think about.
It should work OK. the Kubuntu installer should automatically install the Microsoft-signed Shim shimx64.efi and signed kernels during setup, even if secure boot is off at the time.

When you boot Kubuntu with Secure Boot ON, your firmware loads/accesses the Shim,
which then checks the signature of your Linux bootloader grubx64.efi and verifies it
with a secondary key provided by your Kubuntu/Ubuntu distribution, and boots Kubuntu.

At first, I was thinking that after turning secure boot on, you might have to re-install GRUB (sudo grub-install) so it catches the secure boot's Shim,
but that should NOT be necessary in many cases. (There is the issue of being booted into Kubuntu so you could even issue that command ... or chrooting ...)

I did some quick searching and found some stuff that could mess things up.
If you use open-source drivers, graphic drivers, etc., there should be no problem.
If, however, you use 3rd-party proprietary drivers (graphics, WiFi, etc.), you could have a problem (that code would be unsigned).
The fix would involve looking into MOK, Machine Owner Keys, and it seems fixable.
(I did ask AI about MOK, and its response was clear (if it is correct!).)