bit more messiness in the case of +ssse3 -aes i.e. cat /proc/cpuinfo | grep flag flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr serf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 popcnt lahf_lm arat dtherm tpr_shad on boot, where cat /etc/modprobe.d/99-crypto.conf alias aes aes_x86_64 boot log returns journalctl -b | grep aes Nov 30 11:12:31 laptop017 dracut-pre-udev[224]: modprobe: ERROR: could not find module by name='aes_x86_64' Nov 30 11:12:31 laptop017 dracut-pre-udev[224]: modprobe: ERROR: could not insert 'aes_x86_64': Function not implemented at shell lsmod | grep aes (empty) but modprobe aes lsmod | grep aes aes_x86_64 17131 0 works fine adding /etc/sysconfig/kernel INITRD_MODULES="... aes_x86_64 ..." then mkinitrd reboot once booted journalctl -b | grep aes lsmod | grep aes aes_x86_64 17131 0 atm, I'm unclear/inconsistent how to prepare & boot a LUKS-ready initrd without manual intervention