kernel module mokutil: failed to enroll new keys
<p>I'm trying to sign some kernel modules (for virtualbox) as explained <a href="https://askubuntu.com/questions/760671/could-not-load-vboxdrv-after-upgrade-to-ubuntu-16-04-and-i-want-to-keep-secur">here</a>.</p>

<p>As explained there, I create the new keys:</p>

<pre><code>openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 36500 -subj "/CN=Descriptive name/"
</code></pre>

<p>I sign all the modules:</p>

<pre><code>sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxdrv)
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxnetadp)
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxnetflt)
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxpci)
</code></pre>

<p>But when it comes to importing the keys, that fails</p>

<pre><code>$ sudo mokutil --import MOK.der
input password: 
input password again: 
Failed to enroll new keys
</code></pre>

<p>What could be causing this?</p>

<p>EDIT: Actually, I just noticed that I really can't do much with mokutil. For example:</p>

<pre><code>$ sudo mokutil --reset
input password: 
input password again: 
Failed to unset MokNew
Failed to write MokAuth
Failed to unset MokNew
Failed to issue a reset request
</code></pre>

<p>I think that the only commands that don't fail somehow are <code>--sb-state</code> which correctly states that SecureBoot is enabled, and <code>--list-enrolled</code> which lists enrolled keys. Everything else errs in some way.</p>