01. Driver Load Failure: Secure Boot Conflict

Symptom

modprobe reports:

modprobe: ERROR: could not insert 'kcan': Key was rejected by service

Cause

UEFI Secure Boot is enabled. Because the driver is not signed with a key trusted by the current system, the kernel refuses to load the module.

Solutions

Option 1: Disable Secure Boot

1. Restart the computer and enter BIOS / UEFI setup.
2. Open the Security or Boot section.
3. Set Secure Boot to Disabled.
4. Save, restart Linux and load the driver again.

Option 2: Sign and Enroll the Module Key

1. Install the required tool:

sudo apt install mokutil

2. Generate a signing key:

sudo openssl req -new -x509 -newkey rsa:2048 -nodes -out MOK.der -keyout MOK.key -days 36500

3. Enroll the key:

sudo mokutil --import MOK.der

4. Restart and complete key enrollment when prompted.
5. Sign and reinstall the driver module.

Verification

lsmod | grep kcan

Notes

• Disabling Secure Boot reduces the system's boot-chain protection.
• Module signing is recommended for production systems.
• Enterprise systems may require administrator approval for BIOS changes or key enrollment.