Automatically sign NVidia Kernel module in Fedora 35

If you’ve migrated to Fedora from Ubuntu and you have Secure Boot enabled, you might have noticed a significant difference between the 2 distros: Fedora doesn’t automatically sign NVidia kernel module like Ubuntu does. This article is to help you make Fedora as comfortable to use as Ubuntu is in that regard.

Before we start, let’s make sure some preconditions are met:

• you should already have Secure Boot enabled;
• you don’t have NVidia driver installed yet;
• and you should have Fedora installed. 😉

This guide was tested with Fedora 34 and 35, and probably works with older versions.

❗IMPORTANT: Fedora 36 now has official support for module auto signing. If you’re doing a fresh install of Fedora 36, make sure to follow this guide instead.

Now that you’re done, make sure to verify the driver got loaded after reboot:

$> lsmod | grep -i nvidia

nvidia_drm             73728  1
nvidia_modeset       1150976  2 nvidia_drm
nvidia              36954112  129 nvidia_modeset
drm_kms_helper        311296  2 nvidia_drm,i915
drm                   630784  28 drm_kms_helper,nvidia,nvidia_drm,i915,ttm
Code language: Gradle (gradle)

if you have output similar to the one above, then everything went smoothly and you’re all set!

I hope this was helpful.

Happy hacking!

Upgrade to Fedora 36:

If you’re installing Fedora 36 from scratch, please, make sure to follow this guide instead.

If you have just upgraded to Fedora 36 and noticed the driver doesn’t load anymore, do the following steps:

• First remove the kernel module(s) that got compiled, but not signed:
  sudo dnf remove $(dnf list --installed | grep -e "^kmod-nvidia.*\.fc36." | awk '{print $1}')
• Remove the old certificates, you don’t need them anymore:
  sudo rm -f /etc/pki/akmods/certs/public_key.der
sudo rm -f /etc/pki/akmods/private/private_key.priv
• Remove the COPRs, you don’t need them anymore as well:
  sudo dnf copr remove egeretto/kmodtool-secureboot
sudo dnf copr remove egeretto/akmods-secureboot
• Now let’s generate a new certificate pair using the official tool:
  sudo kmodgenca -a
• Then import the certificate:
  sudo mokutil --import /etc/pki/akmods/certs/public_key.der
• Reinstall nvidia kernel module:
  sudo dnf reinstall akmod-nvidia
• Regenerate and sign NVidia kernel module:
  sudo akmods --force
• Reboot and follow the step #5 of the guide above (Enroll the key).

After reboot you should see the module loaded again.