[Post-Install] error: prohibited by secure boot policy. Press any key to continue...

[Snowhog]

I finished upgrading my Desktop PC from 24.04.x to 26.04 with

sudo do-release-upgrade

There were no errors during the upgrade. Upon rebooting and selecting the top entry in the Grub menu, I got the error message "error: prohibited by secure boot policy. Press any key to continue..."

Pressing any key (or just waiting for a few seconds) and the boot process proceeds and I am presented with the login greeter. Enter my pwd and I'm on the 26.04 Desktop. Everything works.

So I googled on:

after upgrade to Kubuntu 26.04 from 24.04, upon rebooting and selecting the first entry in Grub, I see error: prohibited by secure boot policy. Press any key to continue...

The AI answer:

AI Overview

This error occurs when your UEFI Secure Boot blocks an unsigned GRUB module or file from loading during the boot process. To fix it, temporarily disable Secure Boot in your BIOS/UEFI settings, boot into Kubuntu, update and reinstall the signed bootloader packages, and then re-enable Secure Boot.

Fixing the Secure Boot Policy Error
Disable Secure Boot: Restart your computer, enter your BIOS/UEFI settings (by pressing F2, F12, or Del depending on your system), locate the Secure Boot option under the Security or Boot tab, and turn it Off. Save changes and reboot into Kubuntu.

Update Package Files: Open your terminal and update your package lists and signed shim/grub components by running:

sudo apt update
sudo apt install --reinstall grub-efi-amd64-signed shim-signed

Reinstall GRUB: Reinitialize the bootloader to match your system EFI partition:

sudo grub-install
sudo update-grub

Re-enable Secure Boot: Reboot your computer back into your BIOS/UEFI settings, turn Secure Boot back On, save your changes, and start your system normally.



So I followed the steps shown above. With secure boot disabled, booting happens without this error. I then reinstalled the grub-efi-amd64-signed and shim-signed packages. Rebooted and entered the BIOS/UEFI settings and enabled secure boot, saved, and exited.

At the grub menu I selected the top entry in the Grub menu and was again presented with the error message.

This niggle didn't exist in 24.04. So how do I actually 'fix' it now that I'm running 26.04?

[jrwatts]

Did you really run those commands exactly as shown above? They're both actually two commands, and should have a semi-colon at the end of the last word before the second "sudo"....

[Snowhog]

I did run the commands separately.

[Qqmike]

I looked at it like you did. I thought the shim-signed looked a bit funny, but it's OK (syntax-wise, name-wise).
The Google AI agent did say this as the final step:

Step 3: Clear and Re-enable Secure BootRestart your PC and enter the BIOS/UEFI settings again.Go back to the Secure Boot menu.Look for an option that says "Restore Factory Keys" or "Reset to Setup Mode". This forces the motherboard to reload Microsoft and Ubuntu's trusted signing certificates.Change Secure Boot back to Enabled.Save and exit. Your system will now boot into Kubuntu 26.04 normally with Secure Boot active.

[Snowhog]

Go back to the Secure Boot menu.Look for an option that says "Restore Factory Keys" or "Reset to Setup Mode". This forces the motherboard to reload Microsoft and Ubuntu's trusted signing certificates.Change Secure Boot back to Enabled.Save and exit. Your system will now boot into Kubuntu 26.04 normally with Secure Boot active.

My BIOS/UEFI settings have:

Secure Boot [Enabled] (options are Enabled/Disabled) ---->>>>>>>>>> Secure Boot function can be enabled only when the Platform Key(PK) is enrolled and running accordingly.
Secure Boot Mode [Standard] (options are Standard/Custom) ---->>>>> Selects the secure boot mode. This item is to select how the secure boot keys be loaded. This item appears when "Secure Boot" is enabled. [Standard] The system will automatically load the secure keys from BIOS. [Custom] Allows user to configure the secure boot settings and manually load the secure keys.

"Custom] Allows user to configure the secure boot settings and manually load the secure keys." Not sure/comfortable about the 'and manually load the secure keys' bit.

My motherboard is MSI, and the BIOS/UEFI is MSI CLICK BIOS 5

I just disabled Secure Boot. I only have Kubuntu Linux installed on this PC (Windows is gone forever). I don't recall if I previously had it Enabled or Disabled. I didn't look before I upgraded. Maybe it was Disabled and that's why I never saw this error message before.

[Qqmike]

I always install Kubuntu with Secure Boot off. FWIW.

"Restore Factory Keys" or "Reset to Setup Mode"

I think I've heard that called "Restore Factory settings."
I've known a lot of pro's who do that routinely (with UEFI).
I have not used that setting.
But maybe you have some contamination in your BIOS somehow,
upgrading in place? or something.

[die.boer]

I finished upgrading my Desktop PC from 24.04.x to 26.04 with

sudo do-release-upgrade

There were no errors during the upgrade. Upon rebooting and selecting the top entry in the Grub menu, I got the error message "error: prohibited by secure boot policy. Press any key to continue..."

Pressing any key (or just waiting for a few seconds) and the boot process proceeds and I am presented with the login greeter. Enter my pwd and I'm on the 26.04 Desktop. Everything works.

So I googled on:

after upgrade to Kubuntu 26.04 from 24.04, upon rebooting and selecting the first entry in Grub, I see error: prohibited by secure boot policy. Press any key to continue...

The AI answer:

AI Overview

This error occurs when your UEFI Secure Boot blocks an unsigned GRUB module or file from loading during the boot process. To fix it, temporarily disable Secure Boot in your BIOS/UEFI settings, boot into Kubuntu, update and reinstall the signed bootloader packages, and then re-enable Secure Boot.

Fixing the Secure Boot Policy Error
Disable Secure Boot: Restart your computer, enter your BIOS/UEFI settings (by pressing F2, F12, or Del depending on your system), locate the Secure Boot option under the Security or Boot tab, and turn it Off. Save changes and reboot into Kubuntu.

Update Package Files: Open your terminal and update your package lists and signed shim/grub components by running:

sudo apt update
sudo apt install --reinstall grub-efi-amd64-signed shim-signed

Reinstall GRUB: Reinitialize the bootloader to match your system EFI partition:

sudo grub-install
sudo update-grub

Re-enable Secure Boot: Reboot your computer back into your BIOS/UEFI settings, turn Secure Boot back On, save your changes, and start your system normally.



So I followed the steps shown above. With secure boot disabled, booting happens without this error. I then reinstalled the grub-efi-amd64-signed and shim-signed packages. Rebooted and entered the BIOS/UEFI settings and enabled secure boot, saved, and exited.

At the grub menu I selected the top entry in the Grub menu and was again presented with the error message.

This niggle didn't exist in 24.04. So how do I actually 'fix' it now that I'm running 26.04?

output of these 5 please ?

mokutil --sb-state

sudo mokutil --list-enrolled | head

sudo bootctl status

(if bootctl says it isn't using systemd-boot, that's fine.)

sudo efibootmgr -v

ls -l /boot/efi/EFI/ubuntu

[Snowhog]

paul@DesktopPC:~$ mokutil --sb-state
SecureBoot disabled

paul@DesktopPC:~$ sudo mokutil --list-enrolled | head
[key 1]
Owner: 605dab50-e046-4300-abb6-3dd810dd8b23
SHA1 Fingerprint: 76:a0:92:06:58:00:bf:37:69:01:c3:72:cd:55:a9:0e:1f :de:d2:e0
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
b9:41:24:a0:18:2c:92:67
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=GB, ST=Isle of Man, L=Douglas, O=Canonical Ltd., CN=Canonical Ltd. Master Certificate Authority

paul@DesktopPC:~$ sudo bootctl status
[sudo: authenticate] Password:
sudo: 'bootctl': command not found

paul@DesktopPC:~$ sudo efibootmgr -v
BootCurrent: 0000
Timeout: 1 seconds
BootOrder: 0000,0001
Boot0000* Ubuntu HD(1,GPT,8a304aea-6cf7-4ea9-81bd-f8452e1e6b2c,0x800,0x100000)/\EFI\UBUNTU\SHIMX64.EFI
dp: 04 01 2a 00 01 00 00 00 00 08 00 00 00 00 00 00 00 00 10 00 00 00 00 00 ea 4a 30 8a f7 6c a9 4e 81 bd f8 45 2e 1e 6b 2c 02 02 / 04 04 34 00 5c 00 45 00 46 00 49 00 5c 00 55 00 42 00 55 00 4e 00 54 00 55 00 5c 00 53 00 48 00 49 00 4d 00 58 00 36 00 34 00 2e 00 45 00 46 00 49 00 00 00 / 7f ff 04 00
Boot0001* ubuntu HD(1,GPT,89fce8b0-6e11-4a4b-8399-a1db3ff4f759,0x800,0x100000)/\EFI\UBUNTU\SHIMX64.EFI0000424f
dp: 04 01 2a 00 01 00 00 00 00 08 00 00 00 00 00 00 00 00 10 00 00 00 00 00 b0 e8 fc 89 11 6e 4b 4a 83 99 a1 db 3f f4 f7 59 02 02 / 04 04 34 00 5c 00 45 00 46 00 49 00 5c 00 55 00 42 00 55 00 4e 00 54 00 55 00 5c 00 53 00 48 00 49 00 4d 00 58 00 36 00 34 00 2e 00 45 00 46 00 49 00 00 00 / 7f ff 04 00
data: 00 00 42 4f

paul@DesktopPC:~$ sudo ls -l /boot/efi/EFI/ubuntu
total 4560
-rwx------ 1 root root 108 Aug 4 15:26 BOOTX64.CSV
-rwx------ 1 root root 119 Aug 4 15:26 grub.cfg
-rwx------ 1 root root 2828168 Aug 4 15:26 grubx64.efi
-rwx------ 1 root root 856280 Aug 4 15:26 mmx64.efi
-rwx------ 1 root root 966768 Aug 4 15:26 shimx64.efi
paul@DesktopPC:~$

bootctl status:

Kubuntu 26.04 does not use systemd-boot by default. Like the main Ubuntu release, Kubuntu continues to rely on GRUB as its standard default bootloader for installation.

[Qqmike]

Until die.boer returns,
I had never seen the numbers at the end of the .EFI extension: SHIMX64.EFI0000424f

Searching:

Hexadecimal Tags: The 0000424f characters represent internal memory or disk address mapping identifiers appended by some motherboard manufacturers (like Insyde or AMI BIOS variants).

Display Glitch: The system's graphical boot menu or NVRAM variable reader failed to insert a proper space or separator between the file extension and the internal hex data block.
- - - - -

The output of sudo efibootmgr -v looks ok, I think, right?
die.boer is looking for some possible glitch/contamination in the signing.

[die.boer]

looks like you have two Ubuntu EFI entries:
Boot0000 Ubuntu
Boot0001 ubuntu
Notice the different GPT UUIDs:
8a304aea...
89fce8b0...
Those are different EFI System Partitions,which is unusual.
It suggests your machine may have two disks (or two ESPs), and each has an Ubuntu bootloader installed.
please post output of

lsblk -f

[Snowhog]

Not at home. But I do have two PCIe HDDs, but only one installed OS.

[die.boer]

ok , post it when you can (lsblk -f)
oh, and also this

sudo parted -l

[Snowhog]

paul@DesktopPC:~$ sudo parted -l
[sudo: authenticate] Password:
Model: Samsung SSD 980 PRO with Heatsink 2TB (nvme)
Disk /dev/nvme0n1: 2000GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number Start End Size File system Name Flags
1 1049kB 538MB 537MB fat32 boot, esp
2 538MB 2000GB 2000GB btrfs


Model: Samsung SSD 980 PRO with Heatsink 2TB (nvme)
Disk /dev/nvme1n1: 2000GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number Start End Size File system Name Flags
1 1049kB 538MB 537MB fat32 boot, esp
2 538MB 2000GB 2000GB btrfs


paul@DesktopPC:~$

[Snowhog]

Partition	Type	Mount Point	Label	Partition Name	Size	Used
/dev/nvme0n1p1	fat32	/boot/efi			512.00 MiB	6.30 MiB
/dev/nvme0n1p2	btrfs	/	BootDrive		1.82 TiB	146.29 GiB
/dev/nvme1n1p1	fat32				512.00 MiB	6.09 MiB
/dev/nvme2n1p2	btrfs	/mnt/data	DATA		1.82 TiB	5.78 MiB