search

lcp / mokutil

The utility to manipulate machine owner keys
GNU General Public License v3.0
60 stars 37 forks source link

Key was rejected by service - Secure "boots" - Debian 12 - Micro$oft #69

Closed RENANZG closed 11 months ago

RENANZG commented 11 months ago

Noob here. Why can't I make the module work with secure boot enabled?

user@debian:~$ sudo modprobe rtw_8723du
[sudo] senha para user: 
modprobe: ERROR: could not insert 'rtw_8723du': Key was rejected by service
user@debian:~$ sudo modinfo rtw_8723du 
filename:       /lib/modules/6.1.0-11-amd64/kernel/drivers/net/wireless/realtek/rtw88/rtw_8723du.ko
license:        Dual BSD/GPL
description:    Realtek 802.11n wireless 8723du driver
author:         Hans Ulli Kroll <linux@ulli-kroll.de>
alias:          usb:v7392pD611d*dc*dsc*dp*icFFiscFFipFFin*
alias:          usb:v0BDApD723d*dc*dsc*dp*icFFiscFFipFFin*
depends:        rtw_usb,usbcore,rtw_8723d
retpoline:      Y
name:           rtw_8723du
vermagic:       6.1.0-11-amd64 SMP preempt mod_unload modversions

[!NOTE] I thought it was spoiling, it looks like other signed drivers loaded.

user@debian:~ $ sudo modprobe rtw_8723de
user@debian:~$ sudo dmesg | grep cfg80211
[   49.694948] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[   49.695760] cfg80211: Loaded X.509 cert 'benh@debian.org: 577e021cb980e0e820821ba7b54b4961b8b4fadf'
[   49.697892] cfg80211: Loaded X.509 cert 'romain.perier@gmail.com: 3abbc6ec146e09d1b6016ab9d6cf71dd233f0328'
[   49.698217] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'

This is the entire installation procedure that has been adopted: (from here https://github.com/lwfinger/rtw88)

user@debian:~ $ sudo apt-get install make gcc linux-headers-$(uname -r) build-essential git
Lendo listas de pacotes... Pronto
Construindo árvore de dependências... Pronto
Lendo informação de estado... Pronto        
make is already the newest version (4.3-4.1).
gcc is already the newest version (4:12.2.0-3).
linux-headers-6.1.0-11-amd64 is already the newest version (6.1.38-4).
build-essential is already the newest version (12.9).
git is already the newest version (1:2.39.2-1.1).
0 pacotes atualizados, 0 pacotes novos instalados, 0 a serem removidos e 0 não atualizados.
user@debian:~ $ git clone https://github.com/lwfinger/rtw88.git
Cloning into 'rtw88'...
remote: Enumerating objects: 2132, done.
remote: Counting objects: 100% (243/243), done.
remote: Compressing objects: 100% (94/94), done.
remote: Total 2132 (delta 156), reused 201 (delta 149), pack-reused 1889
Receiving objects: 100% (2132/2132), 5.98 MiB | 3.54 MiB/s, done.
Resolving deltas: 100% (1251/1251), done.
user@debian:~ $ ^[[200~cd rtw88~^C
user@debian:~ $ cd rtw88
user@debian:~ /rtw88$ make
make -C /lib/modules/6.1.0-11-amd64/build M=/home/user/rtw88 modules
make[1]: a entrar na pasta "/usr/src/linux-headers-6.1.0-11-amd64"
CC [M]  /home/user/rtw88/main.o
CC [M]  /home/user/rtw88/mac80211.o
CC [M]  /home/user/rtw88/util.o
CC [M]  /home/user/rtw88/debug.o
CC [M]  /home/user/rtw88/tx.o
CC [M]  /home/user/rtw88/rx.o
CC [M]  /home/user/rtw88/mac.o
CC [M]  /home/user/rtw88/phy.o
CC [M]  /home/user/rtw88/coex.o
CC [M]  /home/user/rtw88/efuse.o
CC [M]  /home/user/rtw88/fw.o
CC [M]  /home/user/rtw88/ps.o
CC [M]  /home/user/rtw88/sec.o
CC [M]  /home/user/rtw88/wow.o
CC [M]  /home/user/rtw88/bf.o
CC [M]  /home/user/rtw88/regd.o
CC [M]  /home/user/rtw88/sar.o
LD [M]  /home/user/rtw88/rtw_core.o
CC [M]  /home/user/rtw88/rtw8822b.o
CC [M]  /home/user/rtw88/rtw8822b_table.o
LD [M]  /home/user/rtw88/rtw_8822b.o
CC [M]  /home/user/rtw88/rtw8822be.o
LD [M]  /home/user/rtw88/rtw_8822be.o
CC [M]  /home/user/rtw88/rtw8822bu.o
LD [M]  /home/user/rtw88/rtw_8822bu.o
CC [M]  /home/user/rtw88/rtw8822bs.o
LD [M]  /home/user/rtw88/rtw_8822bs.o
CC [M]  /home/user/rtw88/rtw8822c.o
CC [M]  /home/user/rtw88/rtw8822c_table.o
LD [M]  /home/user/rtw88/rtw_8822c.o
CC [M]  /home/user/rtw88/rtw8822ce.o
LD [M]  /home/user/rtw88/rtw_8822ce.o
CC [M]  /home/user/rtw88/rtw8822cu.o
LD [M]  /home/user/rtw88/rtw_8822cu.o
CC [M]  /home/user/rtw88/rtw8822cs.o
LD [M]  /home/user/rtw88/rtw_8822cs.o
CC [M]  /home/user/rtw88/rtw8723d.o
CC [M]  /home/user/rtw88/rtw8723d_table.o
LD [M]  /home/user/rtw88/rtw_8723d.o
CC [M]  /home/user/rtw88/rtw8723de.o
LD [M]  /home/user/rtw88/rtw_8723de.o
CC [M]  /home/user/rtw88/rtw8723du.o
LD [M]  /home/user/rtw88/rtw_8723du.o
CC [M]  /home/user/rtw88/rtw8723ds.o
LD [M]  /home/user/rtw88/rtw_8723ds.o
CC [M]  /home/user/rtw88/rtw8821c.o
CC [M]  /home/user/rtw88/rtw8821c_table.o
LD [M]  /home/user/rtw88/rtw_8821c.o
CC [M]  /home/user/rtw88/rtw8821ce.o
LD [M]  /home/user/rtw88/rtw_8821ce.o
CC [M]  /home/user/rtw88/rtw8821cs.o
LD [M]  /home/user/rtw88/rtw_8821cs.o
CC [M]  /home/user/rtw88/rtw8821cu.o
LD [M]  /home/user/rtw88/rtw_8821cu.o
CC [M]  /home/user/rtw88/pci.o
LD [M]  /home/user/rtw88/rtw_pci.o
CC [M]  /home/user/rtw88/sdio.o
LD [M]  /home/user/rtw88/rtw_sdio.o
CC [M]  /home/user/rtw88/usb.o
LD [M]  /home/user/rtw88/rtw_usb.o
MODPOST /home/user/rtw88/Module.symvers
CC [M]  /home/user/rtw88/rtw_8723d.mod.o
LD [M]  /home/user/rtw88/rtw_8723d.ko
BTF [M] /home/user/rtw88/rtw_8723d.ko
Skipping BTF generation for /home/user/rtw88/rtw_8723d.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8723de.mod.o
LD [M]  /home/user/rtw88/rtw_8723de.ko
BTF [M] /home/user/rtw88/rtw_8723de.ko
Skipping BTF generation for /home/user/rtw88/rtw_8723de.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8723ds.mod.o
LD [M]  /home/user/rtw88/rtw_8723ds.ko
BTF [M] /home/user/rtw88/rtw_8723ds.ko
Skipping BTF generation for /home/user/rtw88/rtw_8723ds.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8723du.mod.o
LD [M]  /home/user/rtw88/rtw_8723du.ko
BTF [M] /home/user/rtw88/rtw_8723du.ko
Skipping BTF generation for /home/user/rtw88/rtw_8723du.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8821c.mod.o
LD [M]  /home/user/rtw88/rtw_8821c.ko
BTF [M] /home/user/rtw88/rtw_8821c.ko
Skipping BTF generation for /home/user/rtw88/rtw_8821c.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8821ce.mod.o
LD [M]  /home/user/rtw88/rtw_8821ce.ko
BTF [M] /home/user/rtw88/rtw_8821ce.ko
Skipping BTF generation for /home/user/rtw88/rtw_8821ce.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8821cs.mod.o
LD [M]  /home/user/rtw88/rtw_8821cs.ko
BTF [M] /home/user/rtw88/rtw_8821cs.ko
Skipping BTF generation for /home/user/rtw88/rtw_8821cs.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8821cu.mod.o
LD [M]  /home/user/rtw88/rtw_8821cu.ko
BTF [M] /home/user/rtw88/rtw_8821cu.ko
Skipping BTF generation for /home/user/rtw88/rtw_8821cu.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8822b.mod.o
LD [M]  /home/user/rtw88/rtw_8822b.ko
BTF [M] /home/user/rtw88/rtw_8822b.ko
Skipping BTF generation for /home/user/rtw88/rtw_8822b.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8822be.mod.o
LD [M]  /home/user/rtw88/rtw_8822be.ko
BTF [M] /home/user/rtw88/rtw_8822be.ko
Skipping BTF generation for /home/user/rtw88/rtw_8822be.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8822bs.mod.o
LD [M]  /home/user/rtw88/rtw_8822bs.ko
BTF [M] /home/user/rtw88/rtw_8822bs.ko
Skipping BTF generation for /home/user/rtw88/rtw_8822bs.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8822bu.mod.o
LD [M]  /home/user/rtw88/rtw_8822bu.ko
BTF [M] /home/user/rtw88/rtw_8822bu.ko
Skipping BTF generation for /home/user/rtw88/rtw_8822bu.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8822c.mod.o
LD [M]  /home/user/rtw88/rtw_8822c.ko
BTF [M] /home/user/rtw88/rtw_8822c.ko
Skipping BTF generation for /home/user/rtw88/rtw_8822c.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8822ce.mod.o
LD [M]  /home/user/rtw88/rtw_8822ce.ko
BTF [M] /home/user/rtw88/rtw_8822ce.ko
Skipping BTF generation for /home/user/rtw88/rtw_8822ce.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8822cs.mod.o
LD [M]  /home/user/rtw88/rtw_8822cs.ko
BTF [M] /home/user/rtw88/rtw_8822cs.ko
Skipping BTF generation for /home/user/rtw88/rtw_8822cs.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_8822cu.mod.o
LD [M]  /home/user/rtw88/rtw_8822cu.ko
BTF [M] /home/user/rtw88/rtw_8822cu.ko
Skipping BTF generation for /home/user/rtw88/rtw_8822cu.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_core.mod.o
LD [M]  /home/user/rtw88/rtw_core.ko
BTF [M] /home/user/rtw88/rtw_core.ko
Skipping BTF generation for /home/user/rtw88/rtw_core.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_pci.mod.o
LD [M]  /home/user/rtw88/rtw_pci.ko
BTF [M] /home/user/rtw88/rtw_pci.ko
Skipping BTF generation for /home/user/rtw88/rtw_pci.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_sdio.mod.o
LD [M]  /home/user/rtw88/rtw_sdio.ko
BTF [M] /home/user/rtw88/rtw_sdio.ko
Skipping BTF generation for /home/user/rtw88/rtw_sdio.ko due to unavailability of vmlinux
CC [M]  /home/user/rtw88/rtw_usb.mod.o
LD [M]  /home/user/rtw88/rtw_usb.ko
BTF [M] /home/user/rtw88/rtw_usb.ko
Skipping BTF generation for /home/user/rtw88/rtw_usb.ko due to unavailability of vmlinux
make[1]: a sair da pasta "/usr/src/linux-headers-6.1.0-11-amd64"
user@debian:~/rtw88$ sudo make sign-install
make -C /lib/modules/6.1.0-11-amd64/build M=/home/user/rtw88 modules
make[1]: a entrar na pasta "/usr/src/linux-headers-6.1.0-11-amd64"
make[1]: a sair da pasta "/usr/src/linux-headers-6.1.0-11-amd64"
...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+..+...............+.......+......+...............+..+...+...............+....+......+..+.+............+........+.+.........+..+...+....+...+........+.+.....+....+.....+.......+..+.+.........+..................+.....+...+.+........+............+.........+.+...+..+......+.......+...+...+...........+.+.....+....+........+...............+......+.+...+...........+......+.........+......+.........+..........+...........+.+..+.+...............+.....+....+.....+.+............+..+...............+...+.......+...+.....+.........+.+........+....+...+...+.........+.....+..........+......+......+.....+....+......+.....+...+...+....+......+..+............+.....................+....+...+..+...+......+.+......+..+......+.+......+..................+..+...+.+.................................+........+....+...........+.......+...........+.+.........+.....+.......+..+..........+..+...+.............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.....+..+...+......+...+.......+......+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..........+.....+...+.+...+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+....+.....+...+.+............+..+...+...+....+.....+.+.....+.+...........+...................+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
input password: 
input password again: 
Install rtw88 SUCCESS
user@debian:~ /rtw88$

[!NOTE] With secure boot disabled the drive works normally. 

user@debian:~$ sudo dmesg | grep rtw
[   50.040609] rtw_core: loading out-of-tree module taints kernel.
[   50.040853] rtw_core: module verification failed: signature and/or required key missing - tainting kernel
[   50.085018] rtw_8723du 1-4:1.2: firmware: direct-loading firmware rtw88/rtw8723d_fw.bin
[   50.085029] rtw_8723du 1-4:1.2: Firmware version 48.0.0, H2C version 0
[   50.508946] usbcore: registered new interface driver rtw_8723du
[   50.515855] rtw_8723du 1-4:1.2 wlx4607b84d436b: renamed from wlan0

As for the kernel:

user@debian:~$ sudo ls /var/lib/shim-signed/mok/
MOK.der  MOK.pem  MOK.priv
user@debian:~$ sudo ls /boot
config-6.1.0-10-amd64      keyfile.gpg
config-6.1.0-11-amd64      lost+found
efi                        System.map-6.1.0-10-amd64
grub                       System.map-6.1.0-11-amd64
initrd.img-6.1.0-10-amd64  vmlinuz-6.1.0-10-amd64
initrd.img-6.1.0-11-amd64  vmlinuz-6.1.0-11-amd64
user@debian:/boot$ sudo sbverify --cert /var/lib/shim-signed/mok/MOK.crt /boot/vmlinuz-6.1.0-11-amd64
Can't load certificate from file '/var/lib/shim-signed/mok/MOK.crt'
40A7D7391F7F0000:error:80000002:system library:BIO_new_file:No such file or directory:../crypto/bio/bss_file.c:67:calling fopen(/var/lib/shim-signed/mok/mok.crt, r)
40A7D7391F7F0000:error:10000080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:75:
user@debian:~$ sudo modinfo /boot/vmlinuz-6.1.0-11-amd64
modinfo: ERROR: Module /boot/vmlinuz-6.1.0-11-amd64 not found.
user@debian:~$ sudo sbverify --list /boot/vmlinuz-6.1.0-11-amd64
signature 1
image signature issuers:
 - /CN=Debian Secure Boot CA
image signature certificates:
 - subject: /CN=Debian Secure Boot Signer 2022 - linux
   issuer:  /CN=Debian Secure Boot CA
signature 2
image signature issuers:
 - /CN=user
image signature certificates:
 - subject: /CN=user
   issuer:  /CN=user
user@debian:~$ sudo sbverify --list /boot/vmlinuz-6.1.0-10-amd64
signature 1
image signature issuers:
 - /CN=Debian Secure Boot CA
image signature certificates:
 - subject: /CN=Debian Secure Boot Signer 2022 - linux
   issuer:  /CN=Debian Secure Boot CA

As for wifi:

user@debian:~$ sudo modprobe rtw_8723du
modprobe: ERROR: could not insert 'rtw_8723du': Key was rejected by service
user@debian:~$ sudo modinfo rtw_8723du 
filename:       /lib/modules/6.1.0-11-amd64/kernel/drivers/net/weless/realtek/rtw88/rtw_8723du.ko
license:        Dual BSD/GPL
description:    Realtek 802.11n wireless 8723du driver
author:         Hans Ulli Kroll <linux@ulli-kroll.de>
alias:          usb:v7392pD611d*dc*dsc*dp*icFFiscFFipFFin*
alias:          usb:v0BDApD723d*dc*dsc*dp*icFFiscFFipFFin*
depends:        rtw_usb,usbcore,rtw_8723d
retpoline:      Y
name:           rtw_8723du
vermagic:       6.1.0-11-amd64 SMP preempt mod_unload modversion
user@debian:~$ sudo dmesg | grep  cert 
[    2.178399] Loading compiled-in X.509 certificates
[    2.204942] Loaded X.509 cert 'Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1'
[    2.204969] Loaded X.509 cert 'Debian Secure Boot Signer 2022 - linux: 14011249c2675ea8e5148542202005810584b25f'
[    2.213359] integrity: Loading X.509 certificate: UEFI:db
[    2.213408] integrity: Loaded X.509 cert 'Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4'
[    2.213410] integrity: Loading X.509 certificate: UEFI:db
[    2.213435] integrity: Loaded X.509 cert 'Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53'
[    2.215204] integrity: Loading X.509 certificate: UEFI:MokListRT (MOKvar table)
[    2.215485] integrity: Loaded X.509 cert 'Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1'
[    2.215487] integrity: Loading X.509 certificate: UEFI:MokListRT (MOKvar table)
[    2.215745] integrity: Loaded X.509 cert 'user: 7a9d69f5051c39fe7b84587f816603db9499cec6'
[    2.215746] integrity: Loading X.509 certificate: UEFI:MokListRT (MOKvar table)
[    2.216001] integrity: Loaded X.509 cert 'Custom MOK: 612c79bd5af57aebc802fb2f51dd54d4c4382d41'
[  109.634564] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[  109.634859] cfg80211: Loaded X.509 cert 'benh@debian.org: 577e021cb980e0e820821ba7b54b4961b8b4fadf'
[  109.635145] cfg80211: Loaded X.509 cert 'romain.perier@gmail.com: 3abbc6ec146e09d1b6016ab9d6cf71dd233f0328'
[  109.635465] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'

p6gnpk9tb8j81

[b]I'm pretty sure it has to do with DKMS, as the Debian Wiki tutorial confused me. [/b]

Some possible causes:

  1. Cause:: Kernel module was at two different locations. I found this strange situation:

    user@debian:~$ sudo ls /lib/modules/
6.1.0-10-amd64  6.1.0-11-amd64
user@debian:~$ sudo ls /var/lib/dkms
user@debian:~$ sudo ls /boot
config-6.1.0-10-amd64      keyfile.gpg
config-6.1.0-11-amd64      lost+found
efi                        System.map-6.1.0-10-amd64
grub                       System.map-6.1.0-11-amd64
initrd.img-6.1.0-10-amd64  vmlinuz-6.1.0-10-amd64
initrd.img-6.1.0-11-amd64  vmlinuz-6.1.0-11-amd64
    user@debian:~$ sudo modprobe -v rtw_8723du
insmod /lib/modules/6.1.0-11-amd64/kernel/drivers/net/wireless/realtek/rtw88/rtw_usb.ko 
modprobe: ERROR: could not insert 'rtw_8723du': Key was rejected by service

    Other signated driver "de", much more estrange:

    user@debian:~$ sudo modprobe -v rtw_8723de
insmod /lib/modules/6.1.0-11-amd64/kernel/drivers/net/wireless/realtek/rtw88/rtw_pci.ko 
insmod /lib/modules/6.1.0-11-amd64/kernel/drivers/net/wireless/realtek/rtw88/rtw_8723de.ko  
user@debian:~$ sudo modprobe -v rtw_8723de
????????????SHOW ONLY ONE TIME?????????????????????????

  2. Cause: need to create a X.509 key pair (a public key and a corresponding secret key) to use as a MOK.

  3. Cause: Error with DKMS "With the current state of the DKMS package, if a user attempts to install any package that includes a third-party driver (Broadcom WiFi, VirtualBox, v4l2loobpack, etc.), the process of signing the newly built driver with a MOK key will fail silently. This means that any packages and hardware that require third-party drivers are currently unusable on a system with Secure Boot. This bug has been tested and verified to occur with the bcmwl-kernel-source package, but also is very likely to affect any other packages that use DKMS modules."

EnOiVqnXMAAKk7h

Its correct to say that "Microsoft screwed this whole MOK stuff up badly" ?

Debian Bug report logs - #989463 please align shim-signed dkms behaviour with Ubuntu

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989463

Thanks !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

lcp commented 11 months ago

Your modinfo doesn't show any signature in the module.

user@debian:~$ sudo modinfo rtw_8723du 
filename:       /lib/modules/6.1.0-11-amd64/kernel/drivers/net/wireless/realtek/rtw88/rtw_8723du.ko
license:        Dual BSD/GPL
description:    Realtek 802.11n wireless 8723du driver
author:         Hans Ulli Kroll <linux@ulli-kroll.de>
alias:          usb:v7392pD611d*dc*dsc*dp*icFFiscFFipFFin*
alias:          usb:v0BDApD723d*dc*dsc*dp*icFFiscFFipFFin*
depends:        rtw_usb,usbcore,rtw_8723d
retpoline:      Y
name:           rtw_8723du
vermagic:       6.1.0-11-amd64 SMP preempt mod_unload modversions

The example of a proper signed module:

# modinfo rtw88_8723d
filename:       /lib/modules/5.14.21-150500.55.12-default/kernel/drivers/net/wireless/realtek/rtw88/rtw88_8723d.ko.zst
license:        Dual BSD/GPL
description:    Realtek 802.11n wireless 8723d driver
author:         Realtek Corporation
firmware:       rtw88/rtw8723d_fw.bin
suserelease:    SLE15-SP5
srcversion:     954CA4E2A92196B0BE8E3E6
depends:        rtw88_core
supported:      yes
retpoline:      Y
intree:         Y
name:           rtw88_8723d
vermagic:       5.14.21-150500.55.12-default SMP preempt mod_unload modversions 
sig_id:         PKCS#7
signer:         SUSE Linux Enterprise Secure Boot CA
sig_key:        CA:FC:B5:D7:5E:C5:89:82
sig_hashalgo:   sha256
signature:      91:30:AA:2A:A8:F9:6C:C7:06:C3:BD:B3:3A:2D:B3:D2:BF:85:4F:09:
                3D:5A:E9:52:B9:BC:BF:0D:47:85:65:47:C9:C9:7C:D8:76:00:E7:09:
                6F:04:B3:99:ED:DA:F2:27:2E:34:AF:B8:E1:17:0A:1C:87:D8:61:E3:
                50:64:86:70:D8:26:7A:02:A8:6E:52:A1:3E:19:C2:3E:75:08:CA:EE:
                4C:94:DE:64:A0:28:55:42:D7:7D:E1:E5:53:0D:94:FE:F4:B1:0C:3E:
                C1:A4:82:0D:28:A0:57:4A:03:09:82:14:2E:86:80:96:7E:5B:95:D6:
                4F:DD:D8:10:FB:96:DA:EC:BC:AC:1C:5F:15:2A:24:BA:64:9C:0B:35:
                6F:84:BF:DC:44:C8:E5:B4:9C:8A:DB:A9:66:30:9F:E9:7E:E0:A3:54:
                08:3E:A6:FE:A5:28:AA:55:E6:AB:07:0D:B2:FB:60:9A:F2:86:39:CF:
                32:78:B1:77:F9:31:13:50:3E:CA:8D:44:2A:BD:69:C3:9C:19:7B:E1:
                5C:2D:3E:45:20:58:30:B7:FD:11:BF:D9:60:95:39:17:04:56:9C:A7:
                99:C0:5A:18:30:14:A4:B9:F0:03:45:5A:7C:DC:4F:40:90:CE:37:5B:
                E5:0F:31:DF:E0:B8:4F:6C:23:AF:B0:2E:27:25:A5:5A

It seems to me that your build process didn't sign the module properly, and this is beyond the scope of mokutil.