Signing an out-of-tree kernel module for Secure Boot
Secure Boot rejects any module the firmware cannot trace to a trusted key. Distribution kernels ship with their own key enrolled, so an out-of-tree module you compile yourself will load on an unsigned system and fail silently on a locked one. The fix is to generate a machine owner key, enroll it, and sign the module after every rebuild.
Generate the key pair
Keep the private key off any machine you do not control. A 2048-bit RSA key is the practical minimum; shim will refuse anything smaller.
openssl req -new -x509 -newkey rsa:2048 \ -keyout MOK.priv -outform DER -out MOK.der \ -days 36500 -subj "/CN=bloodbadger module signing/" mokutil --import MOK.der
Reboot into the MOK manager and enroll the key. The password you set is one-time and is discarded after enrollment.
On the first attempt the module still refused to load after enrollment. The cause was a kernel upgrade between signing and boot: the signature is tied to the module built against that exact kernel version, not to the module name.
Sign on every rebuild
Wire the signing step into your DKMS post-build hook so it cannot be forgotten.
/usr/src/linux-headers-$(uname -r)/scripts/sign-file \ sha256 MOK.priv MOK.der module.ko modinfo module.ko | grep -i signer
If signer comes back empty, the module was rebuilt after signing. Sign again, then load.