Comment # 64 on bug 1175626 from John Shaw

(In reply to John Shaw from comment #63)
> > 
> > Be careful with "reinstalling", as noted above that procedure is a bit
> > flawed in the current release. It's better to uninstall and install again.
> > 
> > Please provide output of mokutil --list-enrolled, mokutil --list-new,
> > mokutil --list-delete.
> 

A bit more info, and maybe a clue ...

I imported the nVidia certificate for the latest driver, so it shows up in with
--list-new. This should force MOK manager to attempt to enroll it. If I boot
with SecureBoot enabled, it hangs BUT the first time I tried I had a mostly
black screen, with green "noise" along the top. This was the first time I saw
this phenomena, and it looks like the video driver (?) crashes when trying to
display the MOK screen. Repeating the boot resulted in a pure black screen, so
I guess the green noise is a random thing.

My machine has two nVidia cards in it. A GTX 950 drives two monitors, and a
Quadro GV100 is used for Cuda development. This is not "normal" for a home
computer (the GV100 costs ~$8.5k). This may be the difference causing the
problem, but I cannot imaging why, as the BIOS display clearly has no problem
with it and it has nothing to do with nVidia drivers. Maybe the way MOK Manager
writes or initializes the display has an issue if multiple graphics cards are
present. If this is the case, maybe this is not worth pursuing at your end.

Anyway, if I then boot with SecureBoot disabled, MOK Manager comes up, but it
does not offer to enroll anything (ie, the nVidia certificate). I can continue,
reset MOK, or import (?) keys or hashes for files. In either of the last two
cases, I cannot get to the certificate file (.der) for the nVidia driver, but I
can navigate the UEFI directory. I guess I could try to import hashes for some
of the \efi\opensuse\*.bin files. Presumably I need at least shim.efi,  
grubx64.efi, and MokManager.efi. Anything else? Clearly none of this matters
with SecureBoot disabled.