ASUS Prime 790-P

Secure Boot on Arch Linux: Enabling Protection for UKI Without Replacing Factory Keys

A detailed guide explains how to configure Secure Boot on Arch Linux for Unified Kernel Images without replacing the motherboard's factory keys or relying on Microsoft certificates. The author chose the minimal-intervention approach of adding a custom key to the existing DB section via the UEFI interface instead of using sbctl enroll-keys or shim. The process begins with backing up existing keys to a FAT-formatted USB drive directly from the BIOS menu. New keys are then generated using sbsigntools and openssl, converted to DER format, and enrolled through the ASUS Prime 790-P UEFI interface. A post-hook script for mkinitcpio automatically signs the UKI after every kernel update, ensuring the entire unified image remains protected. The method preserves the original Microsoft and vendor certificates while adding only the user's own signing key.