2.2.3.1 Adding Keys for Secure Boot Using mokutil

You can import or add new keys for use with Secure Boot.

You can use the command mokutil --help to view additional options.

You must run these command as the root user.

1. Create a DER-formatted X509 certificate file for the key you want to add.
2. Check to see if the key is already active.

   # mokutil --test-key new_target_cert.cer

3. If the key is not currently active, then import the key certificate.

   # mokutil --import new_target_cert.cer