sbctl
Manage UEFI Secure Boot keys and signing
TLDR
Show current secure boot status
$ sbctl status
Create custom secure boot keys$ sbctl create-keys
Enroll keys with Microsoft certificates$ sbctl enroll-keys -m
Auto-setup based on configuration$ sbctl setup --setup
Sign an EFI binary and save to database$ sbctl sign -s path/to/efi_binary
Re-sign all saved files$ sbctl sign-all
Verify all EFI executables are signed$ sbctl verify
SYNOPSIS
sbctl command [options]
DESCRIPTION
sbctl is a user-friendly secure boot key manager. It simplifies creating, enrolling, and managing custom secure boot keys and signing EFI binaries.
Custom keys allow booting only signed kernels and bootloaders, enhancing system security.
PARAMETERS
status
Show secure boot statuscreate-keys
Generate custom secure boot keysenroll-keys
Enroll keys into UEFI firmware-m, --microsoft
Include Microsoft UEFI vendor certificatessign
Sign EFI binary-s, --save
Save file to database for re-signingsign-all
Re-sign all saved filesverify
Verify EFI executables are signed
CONFIGURATION
/var/lib/sbctl/
Default directory storing generated secure boot keys (PK, KEK, db) and the database of signed files.
CAVEATS
Not enrolling Microsoft certificates can brick some systems with Option ROMs. Keys are stored in /var/lib/sbctl by default.
HISTORY
Developed as a user-friendly alternative to manual secure boot key management tools.
SEE ALSO
mokutil(1), efibootmgr(8)