MokManager never appears at boot on Azure with RHEL 8

[RFC1920]

We are attempting to load 3rd party drivers with SecureBoot on a RHEL 8 VM on Azure. I know this is probably not a bug with mokutil, but mokmanager never appears at boot, and the new keys are cleared. This process works just fine for us on physical servers and VMWare. But, with Azure, the serial console appears to not engage until it is too late, or otherwise interrupt the shim boot.

I have confirmed via efibootvars that a shim boot is the default. RedHat sent me some commands to extend the timeout for the boot process, but this only caused a hang for about 2 minutes after the console shows "reboot: Restarting system."

echo -en "\xff\xff" > /tmp/2bytes
efivar -f /tmp/2bytes -A 7 -w -n 605dab50-e046-4300-abb6-3dd810dd8b23-MokTimeout
mokutil --import vendorcrt.der
reboot

Just wondering if there are any possible workarounds for this issue. I am relatively certain it has to do with Azure's console.

[gfl94]

similar case seeing from my side..

found a lot of reference:

#11
https://www.reddit.com/r/linux4noobs/comments/ow771j/how_do_you_get_mokmanager_to_come_up_during_the/
https://www.reddit.com/r/AZURE/comments/undlna/mokmanager_and_serial_console/

confirmed my Azure VM has efibootmgr entry configured correctly, booting from shimx64.efi instead of grubx64.efi:

root@xxx:/boot/efi/EFI# efibootmgr -v
BootCurrent: 0001
Timeout: 0 seconds
BootOrder: 0002,0001
Boot0000* MsTemp        AcpiEx(VMBus,,)/VenHw(9b17e5a2-0891-42dd-b653-80b5c22809ba,d96361baa104294db60572e2ffb1dc7f1a78b3f8821e1848a1c363d806ec15bb)/SCSI(0,0)/HD(15,GPT,2627d760-797e-45fc-b3bc-965cb41cd122,0x2800,0x35000)
Boot0001* ubuntu        HD(15,GPT,2627d760-797e-45fc-b3bc-965cb41cd122,0x2800,0x35000)/File(\EFI\ubuntu\shimx64.efi)
Boot0002* ubuntu_custom HD(1,GPT,e20b901a-844f-4e5f-84e1-12f887ba3071,0x37800,0x3bc8fdf)/File(\EFI\ubuntu\shimx64.efi)

it is still unable to work, not able to see any MokManager entry while rebooting in serial console.

Anyone gets any idea to resolve this?

[Luiz-Monad]

The only way I was able to solve this problem was by following this and burning my key on the firmware before even creating the VM, you have to detach the OSDISK and do that.
https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-secure-boot-custom-uefi

This is also relevant https://sysguides.com/fedora-uefi-secure-boot-with-custom-keys#19-9-add-microsoft-keys-to-uefi-secure-boot