Secure Boot on Arch Linux: Enabling Protection for UKI Without Replacing Factory Keys

Arch Linux, unlike many other distributions, does not enable Secure Boot by default. Installation requires it to be disabled, although users can sign the image themselves. Once enabled, the Arch Wiki offers several configuration methods, but navigating them can be confusing for newcomers.

Secure Boot can be set up using sbctl by replacing all factory UEFI keys, through shim, or by adding a key directly via the UEFI interface. This article provides a step-by-step walkthrough of the third option: adding a custom key through the UEFI menu for use with UKI (Unified Kernel Image).

The goal is not to create an unbreakable Secure Boot setup but to achieve basic protection comparable to the default configuration on Windows. The author avoided shim because it depends on Microsoft certificates and rejected sbctl enroll-keys -m because it replaces the entire PK → KEK → DB chain, which carries higher risk and blurs responsibility between operating systems.

Step 0. Backing Up Keys

Before making changes, back up the existing keys using a FAT-formatted USB drive. Enter the UEFI BIOS, locate the Secure Boot section, and select “Save all keys.” Choose the USB drive from the list of disks. After saving, copy the files to a safe location so they can be restored if needed.

Step 1. Generating the Key

Boot into Arch Linux and install sbsigntools:

sudo pacman -S sbsigntools

Create a secure directory and generate a new 4096-bit RSA key valid for ten years:

sudo install -d -m 700 /etc/secureboot

sudo openssl req -new -x509 -newkey rsa:4096 -sha256 -nodes -days 3650 -subj "/CN=My Arch Linux Secure Boot/" -keyout /etc/secureboot/db.key -out /etc/secureboot/db.pem

Convert the public key to DER format for UEFI enrollment:

sudo openssl x509 -in /etc/secureboot/db.pem -outform DER -out /etc/secureboot/db.cer

Step 2. Enrolling the Key in UEFI DB

Copy db.cer to a USB drive and reboot into UEFI. In the Secure Boot menu, add the new key to the DB section. After saving and rebooting, sbctl list-enrolled-keys confirms the custom key appears alongside existing Microsoft and ASUS certificates.

Step 3. Signing the UKI Automatically

Create a post-hook script at /etc/initcpio/post/uki-sbsign that signs the UKI whenever mkinitcpio runs:

#!/usr/bin/env bash

uki="$3"

[[ -n "$uki" ]] || exit 0

key="/etc/secureboot/db.key"

cert="/etc/secureboot/db.pem"

if ! /usr/bin/sbverify --cert "$cert" "$uki" &>/dev/null; then

echo "UKI to sign: $uki"

/usr/bin/sbsign --key "$key" --cert "$cert" --output "$uki" "$uki"

else

echo "UKI already signed, skipping"

fi

Make the script executable and test it with mkinitcpio -P. The hook now signs every new UKI after pacman -Syu. Once Secure Boot is enabled in BIOS, the system boots from the signed image.