0. Before we begin#

I carried out installation on my Dell Precision 5570 laptop, steps to enroll db keys may vary depending on your PC.

There are two separate trust operations:

EFI signing: firmware db trusts systemd-boot and your UKI.
Kernel-module signing: the NVIDIA modules are signed by a key the kernel trusts.

No MOK is needed when booting directly through systemd-boot, provided the module certificate is in firmware db and Fedora imports that key into a keyring accepted for module verification. The tutorials online are mainly about grub+shim and will often require you to enroll a MOK key.

1. Install Required Packages#

Enable RPM Fusion according to the Fedora version, then install:

1sudo dnf install akmods kernel-devel-matched openssl keyutils efitools sbctl

Make sure the matching kernel development files exist:

bash
1KVER=$(uname -r)
2test -x /usr/src/kernels/"$KVER"/scripts/sign-file

2. Create A Dedicated akmods Key#

Generate the Fedora akmods key if the package has not already done so:

1sudo kmodgenca -a

Check the paths:

bash
1sudo readlink -e /etc/pki/akmods/private/private_key.priv
2sudo readlink -e /etc/pki/akmods/certs/public_key.der

Both commands must return real files.

Confirm the certificate:

bash
1sudo openssl x509 \
2  -inform DER \
3  -in /etc/pki/akmods/certs/public_key.der \
4  -noout -subject -issuer -fingerprint -sha256

This should not be null

3. Fix Akmods Key Permissions#

The RPM build runs as the unprivileged akmods user. Root could resolve and read the symlink, but akmods could not access its target. Consequently this test failed inside the build:

bash
1[ -e /etc/pki/akmods/private/private_key.priv ]

The shell short-circuited the signing condition, so it never checked public_key.der and never called /usr/lib/rpm/brp-kmodsign.

Apply permissions to the resolved targets as well as ensuring directory traversal:

bash
 1PRIVATE=$(sudo readlink -e /etc/pki/akmods/private/private_key.priv)
 2PUBLIC=$(sudo readlink -e /etc/pki/akmods/certs/public_key.der)
 3
 4sudo chown root:akmods "$PRIVATE"
 5sudo chmod 640 "$PRIVATE"
 6
 7sudo chown root:akmods "$PUBLIC"
 8sudo chmod 644 "$PUBLIC"
 9
10sudo chown root:akmods /etc/pki/akmods/private
11sudo chmod 750 /etc/pki/akmods/private
12
13sudo chmod 755 /etc/pki/akmods/certs
14sudo restorecon -RFv /etc/pki/akmods

Test using the identity that performs the build:

bash
1sudo -u akmods test -r /etc/pki/akmods/private/private_key.priv
2sudo -u akmods test -r /etc/pki/akmods/certs/public_key.der

Both must return 0.

Confirm the key and certificate match:

bash
1sudo openssl pkey \
2  -in /etc/pki/akmods/private/private_key.priv \
3  -pubout -outform DER | sha256sum
4
5sudo openssl x509 \
6  -inform DER \
7  -in /etc/pki/akmods/certs/public_key.der \
8  -pubkey -noout |
9openssl pkey -pubin -outform DER | sha256sum

The hashes must be identical.

4. Enroll The Akmods Certificate In Firmware db#

Convert the DER certificate to PEM because cert-to-efi-sig-list expects PEM input:

bash
1sudo openssl x509 \
2  -inform DER \
3  -in /etc/pki/akmods/certs/public_key.der \
4  -outform PEM \
5  -out /boot/efi/EFI/Linux/akmods.pem

Create an ESL:

bash
1OWNER_GUID=$(uuidgen)
2
3sudo cert-to-efi-sig-list \
4  -g "$OWNER_GUID" \
5  /boot/efi/EFI/Linux/akmods.pem \
6  /boot/efi/EFI/Linux/akmods.esl

Validate that it contains a real certificate:

bash
1sudo sig-list-to-certs \
2  /boot/efi/EFI/Linux/akmods.esl \
3  /tmp/akmods
4
5openssl x509 \
6  -inform DER \
7  -in /tmp/akmods-0.der \
8  -noout -subject -fingerprint -sha256

It must report a nonzero number of bytes and the same SHA-256 fingerprint as public_key.der.

Because Setup Mode is disabled after sbctl enrollment, a plain ESL may not be accepted. Create an authenticated append with the sbctl KEK:

You can set the /boot/efi/EFI/Linux/ to somewhere you want, could be a USB-key if you want.

bash
1sudo sign-efi-sig-list \
-a \
-c /var/lib/sbctl/keys/KEK/KEK.pem \
-k /var/lib/sbctl/keys/KEK/KEK.key \
db \
/boot/efi/EFI/Linux/akmods.esl \
/boot/efi/EFI/Linux/akmods.auth

Append it from Linux:

bash
1sudo efi-updatevar \
2  -a \
3  -f /boot/efi/EFI/Linux/akmods.auth \
4  db

If the firmware blocks Linux variable updates, use Dell firmware:

1Expert Key Management -> db -> Append from File -> akmods.auth

Use append, never replace. Replacing db could remove the sbctl and Microsoft certificates.

Verify after reboot:

1sudo efi-readvar -v db

Confirm that the firmware certificate reached the kernel:

bash
1sudo keyctl list %:.platform
2sudo keyctl list %:.secondary_trusted_keys
3sudo keyctl list %:.machine 2>/dev/null

your certificate should show in at least one outputs.

5. Build And Sign NVIDIA Modules#

First intall the NVIDIA drivers:

bash
1sudo dnf update -y # and reboot if you are not on the latest kernel
2sudo dnf install akmod-nvidia # rhel/centos users can use kmod-nvidia instead
3sudo dnf install xorg-x11-drv-nvidia-cuda #optional for cuda/nvdec/nvenc support

Run from an accessible directory:

bash
1cd /tmp
2KVER=$(uname -r)
3
4sudo akmods \
5  --force \
6  --rebuild \
7  --kernels "$KVER"
8
9sudo depmod -a "$KVER"

and verify the NVIDIA modules are signed:modinfo -F signer nvidia, this should show nonempty fields.

6. Rebuild Initramfs And Reboot#

bash
1sudo dracut --force --kver "$KVER"
2sudo reboot

Finally test the driver:

bash
 1nvidia-smi
 2
 3The output should be like:
 4Sun Jul 26 12:37:08 2026       
 5+-----------------------------------------------------------------------------------------+
 6| NVIDIA-SMI 610.43.03              KMD Version: 610.43.03     CUDA UMD Version: 13.3     |
 7+-----------------------------------------+------------------------+----------------------+
 8| GPU  Name                 Persistence-M | Bus-Id          Disp.A | Volatile Uncorr. ECC |
 9| Fan  Temp   Perf          Pwr:Usage/Cap |           Memory-Usage | GPU-Util  Compute M. |
10|                                         |                        |               MIG M. |
11|=========================================+========================+======================|
12|   0  NVIDIA RTX A1000 Laptop GPU    Off |   00000000:01:00.0 Off |                  N/A |
13| N/A   42C    P0            749W /   40W |      38MiB /   4096MiB |     12%      Default |
14|                                         |                        |                  N/A |
15+-----------------------------------------+------------------------+----------------------+
16
17+-----------------------------------------------------------------------------------------+
18| Processes:                                                                              |
19|  GPU   GI   CI              PID   Type   Process name                        GPU Memory |
20|        ID   ID                                                               Usage      |
21|=========================================================================================|
22|    0   N/A  N/A           18466    C+G   /usr/bin/kwin_wayland                     6MiB |
23+-----------------------------------------------------------------------------------------+