"modprobe: ERROR: could not insert 'nvidia': Key was rejected by service" due to binutils mismatch

Status changed to 'Confirmed' because the bug affects multiple users.

From bug 2014983:

> Fixed by purging everything nvidia, libnvidia, or cuda, and reinstalling through
> the "additional drivers" interface. I also reinstalled linux-headers-$(uname -r).

Please provide complete reinstallation commands.

At a guess:

1. sudo apt remove nvidia-driver-535 nvidia-dkms-535
2. sudo apt purge
3. Reboot.
4. Open the 'Additional Drivers' app in GNOME and use it to reinstall.
5. Reboot again.

Alternatively, just disable Secure Boot in the BIOS :)

Which one of the two?

Which one of the two should I install?

> Amd why are ALL the options disabled for me?

It thinks you installed a driver manually from nvidia.com, which Ubuntu doesn't support. Try this:

  /usr/bin/nvidia-installer --uninstall
  # From http://us.download.nvidia.com/XFree86/Linux-x86_64/535.54.03/README/installdriver.html

Also uninstall any packages from previous drivers, which you can find with:

  dpkg -l | grep nvidia | grep -e '\<[345][0-9][0-9]\.'

and also delete any lingering kernel modules, which you can find with:

  find /usr/lib -name nvidia.ko

then reboot and hopefully the 'Additional Drivers' app will behave better.

nvidia-driver-535 should be best.

No, there are 2 535 drivers listed in the "Additional Drivers" gnome app. Which one should I install?

YES: nvidia-driver-535
NO: nvidia-driver-535-open

Or more generally install whichever one is listed as "tested".

Done but still doesn't work.

$ nvidia-smi
NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver. Make sure that the latest NVIDIA driver is installed and running.

After rebooting, if it still doesn't work then please run:

  journalctl -b0 > journal.txt
  find /var/lib/dkms/nvidia -name make.log

and attach both files here.

journalctl -b0

/var/lib/dkms/nvidia/535.54.03/6.2.0-24-generic/x86_64/log/make.log

And we're back to the original problem. I'm out of ideas sorry, and would just be googling at this stage.

Jul 03 16:45:29 khteh-p17-2i gdm3[3111]: modprobe: ERROR: could not insert 'nvidia': Key was rejected by service
Jul 03 16:45:29 khteh-p17-2i kernel: Loading of module with unavailable key is rejected

That sucks.

Canonical has provided a signature for an exact set of bytes in the .ko file. The packaging needs to relink the object files into that exact set of bytes on the target system for the signature to match. The relinking is required for license compliance AIUI. binutils does the linking. If you use a different version of binutils, it may generate a different set of bytes that fails the signature check.

Can you elaborate on what you think Ubuntu should be doing differently?

What do you mean "different version of binutils"? I don't install these myself.

> Can you elaborate on what you think Ubuntu should be doing differently?
What do you think? I have not been able to use Ubuntu with external monitor for 3 weeks now!

This bug is about installing on a system with a different version of binutils. I assumed that is what you are doing because that is what this bug is about. But based on your comment @khteh, I now assume that you are not hitting the problem I reported. Do you have a reason to believe your issue is caused by binutils, or are you just seeing this same error message?

modprobe: ERROR: could not insert 'nvidia': Key was rejected by service

binutils version differences is not the only reason you might see that error. You may be having an issue unrelated to this bug.

One possibility is that the installation method you selected is trying to build its own version of the module, which is not signed by a trusted Canonical key. The fact that you have a make.log at all (as shown in comment #19) is a hint there. nvidia-driver-535 will try to install the prebuilt and signed modules where possible, but if it can't, it will revert to installing the "source" and building an unsigned one instead. If you have the nvidia-dkms-535 driver installed instead of linux-modules-nvidia-535-generic, then that may be what happened.

If that is the case, you can try switching to the prebuilt/signed one by running:

 sudo apt install nvidia-driver-535 linux-modules-nvidia-535-generic
 sudo apt remove nvidia-dkms-535
 # ^ That should only remove nvidia-dkms-535

I hope that fixes your system.

To no avail

> sudo apt install nvidia-driver-535 linux-modules-nvidia-535-generic
> sudo apt remove nvidia-dkms-535

Not changing anything!

Same here.

> sudo apt install nvidia-driver-535 linux-modules-nvidia-535-generic
> sudo apt remove nvidia-dkms-535

After doing this you also have to roll back the kernel to 6.2.0-24

I solved this issue by installing the original Nvidia drivers and signing it with an individual key.

Because it's complicate, only the steps.
* Remove all nvidia packages using "sudo apt purge nvidia*"
* Download the driver from nvidia.com
* Install the NVIDIA-xxx.run package (choose sign with self created key)
* use mokutil --import /usr/share/nvidia/...to import your key
* reboot and enrolling your key into the sim (choose "Enroll MOK" on grub boot screen)

Confirming that Dann Frazier's answer does make it possible to load the Nvidia drivers.

I upgraded to 23.04 (from 22.10) and got kernel 6.2.0-25. Tried all sorts of different ways to manually sign the Nvidia drivers but nothing worked; the Nvidia drivers would always fail to load.

Here all the steps I took to fix this:

# I removed all packages related to Nvidia as I wanted a clean slate
sudo apt purge nvidia*

# Installed the driver but also the pre-signed module as Dann Frazier suggested
sudo apt install nvidia-driver-535 linux-modules-nvidia-535-generic

# The previous command will install some packages for kernel 6.2.0-24 but you're still missing the modules extra package; install it now:
sudo apt install linux-modules-extra-6.2.0-24-generic

Now reboot and make sure you boot into the 6.2.0-24 kernel and the Nvidia drivers should now load.

https://forums.developer.nvidia.com/t/535-doesnt-work-on-6-2-0-26-generic/261877/6

Works now!

`sudo update-secureboot-policy --enroll-key`

reboot and choose enrol MOK