I've attempted to install rEFInd and though I had it completely set up and working with secure boot disabled, I decided I'd rather have it enabled. So I deleted all the relevant files from the EFI partition and uninstalled the package using Synaptic (I'm using Debian 13), and returned to using grub for the time being.
A bit about my system: it's a relatively old ASUS desktop PC, circa 2015, with a dual drive dual boot setup with Windows 11 and Debian 13.
To be sure I had followed steps correctly, I tried installing again. This time I just installed from the terminal with 'sudo apt install refind'. I got the screen about installing to the ESP partition, which I accepted. I then ran the refind-install script. The script gave back a message along the lines of 'the system has secure boot enabled, suggest to run the install script by passing it a path to a signed shim via --shim. I've been running with secure boot enabled so I was surprised to see this message. Just to be sure though I went to Synaptic and reinstalled the signed shim package. I then ran the refind-install script with --shim /boot/efi/EFI/debian/shimx64.efi as that is where Synaptic placed the new file (in fact all the files there now have today's time and date stamp).
This all looked promising but when I rebooted I got the security violation blue screen and after pressing enter to accept a few times, it booted in Windows. Not sure what to try at this point. I'm aware that some of the certificates expire this month, but from I can tell my system has the newer ones as well. I wonder if the fact that I'm dual booting from separate drives could be the cause?
Last edit: SGL 2026-06-14
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
How does one get a hold of another distribution's shimx64.efi? Was thinking to try it again passing it the other distribution's shim file via --shim, though I'm skeptical it will work any better given that I'm running Debian.
Update: ok I figured out how to extract a deb package to get at the shim file contained therein, and manually placed it in the /refind folder of the efi partition, but it still didn't work. I also tried with a shim from Fedora but no luck there either.
Last edit: SGL 2026-06-14
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I've attempted to install rEFInd and though I had it completely set up and working with secure boot disabled, I decided I'd rather have it enabled. So I deleted all the relevant files from the EFI partition and uninstalled the package using Synaptic (I'm using Debian 13), and returned to using grub for the time being.
A bit about my system: it's a relatively old ASUS desktop PC, circa 2015, with a dual drive dual boot setup with Windows 11 and Debian 13.
To be sure I had followed steps correctly, I tried installing again. This time I just installed from the terminal with 'sudo apt install refind'. I got the screen about installing to the ESP partition, which I accepted. I then ran the refind-install script. The script gave back a message along the lines of 'the system has secure boot enabled, suggest to run the install script by passing it a path to a signed shim via --shim. I've been running with secure boot enabled so I was surprised to see this message. Just to be sure though I went to Synaptic and reinstalled the signed shim package. I then ran the refind-install script with --shim /boot/efi/EFI/debian/shimx64.efi as that is where Synaptic placed the new file (in fact all the files there now have today's time and date stamp).
This all looked promising but when I rebooted I got the security violation blue screen and after pressing enter to accept a few times, it booted in Windows. Not sure what to try at this point. I'm aware that some of the certificates expire this month, but from I can tell my system has the newer ones as well. I wonder if the fact that I'm dual booting from separate drives could be the cause?
Last edit: SGL 2026-06-14
How does one get a hold of another distribution's shimx64.efi? Was thinking to try it again passing it the other distribution's shim file via --shim, though I'm skeptical it will work any better given that I'm running Debian.
Update: ok I figured out how to extract a deb package to get at the shim file contained therein, and manually placed it in the /refind folder of the efi partition, but it still didn't work. I also tried with a shim from Fedora but no luck there either.
Last edit: SGL 2026-06-14