Comprehensive Guide: Fedora, NVIDIA Drivers, and Secure Boot Signing

A step-by-step guide to installing NVIDIA's proprietary drivers on Fedora without disabling Secure Boot, plus fixes for the most common black-screen failures.

Running Fedora Linux on a machine with an NVIDIA graphics card is common, but keeping Secure Boot enabled while using the proprietary NVIDIA drivers requires extra steps. Secure Boot is a valuable security feature that helps protect your system from malware infecting the boot process. Disabling it is an option, but you lose that protection.

This guide provides a comprehensive walkthrough on how to install the official NVIDIA drivers on Fedora Linux while keeping Secure Boot active, by generating a Machine Owner Key (MOK), enrolling it, and ensuring your NVIDIA kernel modules are correctly signed. The process primarily uses akmods, Fedora's standard tool for managing third-party kernel modules like NVIDIA's, which automates the signing process after the initial setup.

Disclaimer: Follow these steps carefully. Incorrect configuration could potentially lead to boot issues. Crucially, securing the private key generated in this process is vital for maintaining your system's security.

Reference Documents:

• RPM Fusion Tutorial
• RPM Fusion Reference Documents

Prerequisites: Before You Begin

1. Enable RPM Fusion Repositories — the standard NVIDIA drivers for Fedora are distributed through the RPM Fusion repositories. Enable them if you haven't already:

sudo dnf install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm

2. Update Your System — ensure your system is fully up to date:

sudo dnf upgrade --refresh

Then reboot. Why? This ensures you are actually running the newest kernel you just downloaded. Never install drivers on a "pending update" system — most black screens happen because you are running Kernel A, but you install drivers for Kernel B.

3. Install Essential Tools — you'll need mokutil for handling MOK keys. Other tools like openssl should typically be present. Necessary kernel headers (kernel-devel, kernel-headers) are usually pulled in automatically when you install akmod-nvidia, but they are essential for module building.

sudo dnf install mokutil openssl kernel-devel kernel-headers

Understanding the Process: MOK and akmods

Secure Boot: works by ensuring that only trusted software (signed with recognized keys) is loaded during boot. Initially, this includes your UEFI firmware, the Fedora bootloader (shim), and the Fedora kernel.

NVIDIA Driver: the proprietary NVIDIA driver includes kernel modules that Secure Boot, by default, won't trust because they aren't signed by Microsoft or Fedora.

Machine Owner Key (MOK): this is a mechanism allowing you (the machine owner) to add your own keys to the Secure Boot trust database. By generating your own key pair and enrolling the public key as a MOK, you can sign the NVIDIA modules, extending Secure Boot's trust to include them.

akmods: this Fedora service automatically rebuilds third-party kernel modules (like NVIDIA's) whenever a new kernel is installed. Crucially, if a MOK is enrolled and the keys are accessible, akmods will also automatically sign these newly built modules for you.

Step 1: Generate Your Signing Key Pair

We need a private key (to sign modules) and a public key (to enroll with Secure Boot). Using /root/ ensures normal users cannot access the private key easily:

• sudo mkdir /root/mok-keys
• cd /root/mok-keys
• sudo openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 3650 -subj "/CN=My NVIDIA Driver Signing Key/"

MOK.priv is your private key — keep it secret, keep it safe. MOK.der is your public key certificate, in DER format for enrollment.

Critical Security Warning

Your MOK.priv private key file is extremely sensitive. Anyone who obtains this key can sign any kernel module, and your system's Secure Boot will trust it — this could allow kernel-level malware to bypass Secure Boot protection entirely on this specific machine.

Protect it — ensure it has strict permissions. Verify with sudo ls -l /root/mok-keys/MOK.priv and ensure only root can read it (permissions -r-------- or 400 are ideal):

sudo chmod 400 /root/mok-keys/MOK.priv

Do not share this private key or store it in insecure locations like your regular home directory without strong encryption. Back it up securely if you manage many systems or consider this key critical.

Alternative location note: akmods often looks for keys in /etc/pki/akmods/private/ and /etc/pki/akmods/certs/. Placing your keys there, potentially named akmods-private.key and akmods.crt, might simplify automatic detection by akmods. However, the /root/ location works if secured properly.

Step 2: Enroll the Public Key (MOK)

Now, tell Secure Boot to trust modules signed with your key by enrolling the public part:

sudo mokutil --import /root/mok-keys/MOK.der

Important: you will be prompted to create a temporary password. Choose one you will remember for the next reboot (8–16 characters recommended) — you only need it once, during the enrollment confirmation step on reboot.

Step 3: Reboot and Complete MOK Enrollment

This step happens during the reboot process, before Fedora fully loads.

1. Reboot your computer: sudo systemctl reboot
2. MOKManager screen — shortly after the manufacturer's logo, a blue screen titled "Perform MOK management" (or similar) will appear. It often has a short timeout, so be ready to press a key. If you miss it, reboot and try again.
3. Select Enroll MOK — use the arrow keys to navigate and Enter to select.
4. Select View key 0 — this lets you confirm the details of the key you are about to enroll. Check that it matches the key you generated.
5. Select Continue after viewing the key.
6. Enroll the key(s)? — it will ask for confirmation. Select "Yes".
7. Enter password — critical step. You must now enter the exact password you created with the mokutil --import command earlier. The input might not show asterisks, so type carefully.
8. Select OK.
9. Select Reboot — the system will now reboot again, this time with the MOK enrolled.

Step 4: Install NVIDIA Drivers Using akmods

Now that Secure Boot trusts your key, install the NVIDIA drivers — akmods will build the module for your current kernel:

sudo dnf install akmod-nvidia xorg-x11-drv-nvidia-cuda nvidia-gpu-firmware

The CUDA package is optional but necessary for GPU-accelerated apps and compute. akmods should start building the module — this can take a few minutes and happens in the background. You must let this complete; if it doesn't, you will get a black screen on reboot. You can monitor its progress roughly using journalctl -f or just wait.

To ensure everything was built correctly, enter:

sudo akmods --force --rebuild

Make sure this command completes with an "[OK]", otherwise it failed. Then:

sudo dracut --force

After the installation finishes, akmods should automatically use your enrolled MOK key (which may have been copied to /etc/pki/akmods/certs/) to sign the newly built NVIDIA modules (nvidia.ko, nvidia-modeset.ko, etc.).

Step 5: Verify Installation and Signing

Reboot one more time to load the newly installed and signed NVIDIA drivers:

sudo systemctl reboot

After logging in, check if the driver is loaded:

lsmod | grep nvidia

You should see lines containing nvidia, nvidia_modeset, nvidia_uvm, etc. Then check if the modules are signed — pick one (e.g. nvidia.ko) and check its signature:

modinfo nvidia | grep signer

If it says signer: your_name, you are safe to use Secure Boot. To be sure, also try:

• sudo find /usr/lib/modules/$(uname -r)/ -name nvidia.ko — common location is /usr/lib/modules/$(uname -r)/extra/nvidia/nvidia.ko
• sudo kmodsign info /usr/lib/modules/$(uname -r)/extra/nvidia/nvidia.ko — the output should include the signer, matching the MOK details you generated. If it shows "Signature: Key expired" or "unsigned," something went wrong.

Still Seeing Black? Fix NVIDIA & LUKS Encryption on Fedora

If you've followed every tutorial, signed your drivers for Secure Boot, and added every GRUB flag known to man, but you're still staring at a black screen while your disk waits for a password you can't see — you aren't alone.

The problem is a "handover" failure: the kernel needs to show you the password prompt before it mounts your drive, but it doesn't have the NVIDIA drivers loaded yet. Here is the fix that finally resolved it.

The problem — the "missing" module: even if your NVIDIA drivers are installed, Fedora's dracut (the tool that builds your boot image) often ignores them because they live in a non-standard /extra/ directory. If the drivers aren't in the initramfs, your monitor won't wake up in time for the encryption prompt.

The solution — force the handover. First, create a persistent dracut configuration — don't just run a one-time command, make this fix permanent so kernel updates don't break it:

sudo nano /etc/dracut.conf.d/nvidia.conf

Paste the following into the file, to force-inject the drivers and ignore the conflicting open-source nouveau driver:

• force_drivers+=" nvidia nvidia_modeset nvidia_uvm nvidia_drm "
• omit_drivers+=" nouveau "
• install_items+=" /etc/modprobe.d/nvidia.conf "

Next, make sure modesetting is triggered so the drivers know how to start:

echo "options nvidia-drm modeset=1" | sudo tee /etc/modprobe.d/nvidia.conf

Then rebuild the boot image:

sudo dracut --force --verbose

Trust but verify before you reboot — confirm the drivers are actually inside the image. If this returns nothing, do not reboot:

lsinitrd /boot/initramfs-$(uname -r).img | grep nvidia.ko

If you see a path ending in extra/nvidia/nvidia.ko, you've won.

Last resort: on some recent Fedora builds (Fedora 43 with kernel 6.17+), the only thing that works is forcing a manual rebuild naming the kernel modules directly. Run uname -r to get your current kernel version, then:

sudo dracut --force --verbose --kver <your-kernel-version> --add-drivers "nvidia nvidia_modeset nvidia_uvm nvidia_drm" -I /etc/modprobe.d/nvidia.conf

Verify with:

lsinitrd /boot/initramfs-<your-kernel-version>.img | grep -E "nvidia.ko|nvidia.conf"

If this last-resort option is the only thing that worked for you, you will have to repeat the manual rebuild after every kernel update.

Ongoing Maintenance: Kernel Updates

The beauty of this setup is akmods. When you update your Fedora system and get a new kernel:

1. dnf installs the new kernel.
2. akmods automatically detects the new kernel and rebuilds the NVIDIA modules for it.
3. akmods then uses your enrolled MOK private key to sign these new modules automatically.

You generally don't need to do anything manually for kernel updates after the initial MOK enrollment and driver install — unless the last-resort option above was the only thing that worked for you, in which case you'll need to manually rebuild the dracut image after every kernel update.

Manual Signing (For Understanding & Troubleshooting)

You typically shouldn't need to do this if akmods is working correctly. However, it's useful for understanding the process or if akmods fails to sign for some reason.

1. Identify modules — the core NVIDIA modules are usually nvidia.ko, nvidia-modeset.ko, nvidia-drm.ko, and nvidia-uvm.ko.
2. Find location — locate them under /usr/lib/modules/$(uname -r)/, often in extra/nvidia/ or similar subdirectories.
3. Sign — use the sign-file script with the private key and public certificate generated in Step 1: sudo /usr/src/kernels/$(uname -r)/scripts/sign-file sha512 /root/mok-keys/MOK.priv /root/mok-keys/MOK.der /usr/lib/modules/$(uname -r)/extra/nvidia/nvidia.ko

Troubleshooting Tips

Black screen after boot:

• At the GRUB boot menu, highlight the top entry and press e. Remove rhgb quiet and add nomodeset at the end of the line — this lets you boot with graphics disabled so you can troubleshoot.
• Did the MOK enroll correctly? Check sudo mokutil --list-enrolled (look for your key's subject).
• Did akmods build the module for the current kernel? Check lsmod | grep nvidia. If not, try forcing a build with sudo akmods --force, then reboot.
• Are the modules signed correctly? Use sudo kmodsign info /path/to/nvidia.ko. If not, try manual signing.
• Check Xorg or Wayland logs for errors (/var/log/Xorg.0.log or journalctl -e _COMM=gdm-x-session / journalctl -e _COMM=gnome-shell).
• If you get a black screen, try rerunning sudo akmods --force and sudo dracut --force first.

Drivers don't persist after a kernel update: this should be handled by akmods. Ensure the akmods service is enabled (sudo systemctl enable akmods.service --now). Check /var/log/akmods/ for build logs. Ensure your private key is secure but accessible by root for signing.

MOK enrollment failed: did you enter the correct password during the MOKManager reboot step? If unsure, you might need to reset the MOK list (sudo mokutil --reset, requires reboot and confirmation) and re-import/re-enroll. Be cautious with --reset.

To revert to the original drivers: run sudo dnf remove *nvidia* --exclude=nvidia-gpu-firmware and sudo grubby --update-kernel=ALL --remove-args='rd.driver.blacklist=nouveau modprobe.blacklist=nouveau nvidia-drm.modeset=1', then sudo dracut --force.

Alternative: Disabling Secure Boot

You can always disable Secure Boot in your system's UEFI/BIOS settings. This avoids all signing complexity. However, you lose the security benefit of protection against malicious software interfering early in the boot process (bootkits/rootkits). This guide focuses on keeping Secure Boot enabled for better security.

Conclusion

Setting up NVIDIA drivers with Secure Boot on Fedora involves a few careful steps, primarily generating and enrolling your own Machine Owner Key (MOK). Once done, akmods handles the ongoing signing process automatically during kernel updates. By following this guide, you can enjoy NVIDIA's proprietary drivers while maintaining the valuable protection offered by Secure Boot. Remember to always prioritize the security of your generated private key.