title: kernel module mokutil: failed to enroll new keys
body: <p>I'm trying to sign some kernel modules (for virtualbox) as explained <a href="https://askubuntu.com/questions/760671/could-not-load-vboxdrv-after-upgrade-to-ubuntu-16-04-and-i-want-to-keep-secur">here</a>.</p>
  
  <p>As explained there, I create the new keys:</p>
  
  <pre><code>openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 36500 -subj "/CN=Descriptive name/"
  </code></pre>
  
  <p>I sign all the modules:</p>
  
  <pre><code>sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxdrv)
  sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxnetadp)
  sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxnetflt)
  sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxpci)
  </code></pre>
  
  <p>But when it comes to importing the keys, that fails</p>
  
  <pre><code>$ sudo mokutil --import MOK.der
  input password: 
  input password again: 
  Failed to enroll new keys
  </code></pre>
  
  <p>What could be causing this?</p>
  
  <p>EDIT: Actually, I just noticed that I really can't do much with mokutil. For example:</p>
  
  <pre><code>$ sudo mokutil --reset
  input password: 
  input password again: 
  Failed to unset MokNew
  Failed to write MokAuth
  Failed to unset MokNew
  Failed to issue a reset request
  </code></pre>
  
  <p>I think that the only commands that don't fail somehow are <code>--sb-state</code> which correctly states that SecureBoot is enabled, and <code>--list-enrolled</code> which lists enrolled keys. Everything else errs in some way.</p>