SECURE BOOT

You’ve made a bootable USB stick, picked it in the boot menu, and the PC refuses it. You might get a message such as Secure Boot Violation or Invalid signature detected, or the PC might just return to the menu. The usual cause is Secure Boot. Here’s what it is, why it happens, and what to try, in a sensible order.

A drive can pass verification and still be refused by a computer’s firmware. Work through the checks below before changing firmware settings.

What Secure Boot does

Secure Boot is a feature of your PC’s firmware, the UEFI settings that run before Windows. When the PC starts, Secure Boot checks that the first piece of start-up software carries a digital signature from someone on the PC’s list of trusted keys. If it doesn’t, that software isn’t allowed to run. It’s there to stop malicious software hiding in the start-up process, before Windows and your antivirus are running. It’s a good thing to have on.

Many Linux distributions, Ubuntu included, are built to work with Secure Boot: they start from a small loader that’s signed so standard PCs will trust it. So on most PCs, an Ubuntu stick starts with Secure Boot left on.

Why a stick gets refused

• The software on the stick isn’t signed for Secure Boot. Some smaller Linux distributions and older tools aren’t.
• The PC trusts fewer keys than most. Some PCs, particularly some newer business laptops, trust only Microsoft’s own Windows key by default, not the key used to sign Linux and other third-party start-up software. Their firmware may have a setting to allow third-party software.
• The download is out of date. When a security flaw is found in start-up software, the old versions can be blocked by a firmware or Windows update. An old ISO can stop working on a fully updated PC, while the current download works fine.
• The PC’s firmware is fussy or buggy. It happens. A firmware update from the PC’s maker sometimes helps.

What it almost never is: the USB stick having been written wrongly. If DiskSnap finished with Verify: passed, the stick holds exactly what was in the image.

What to check first

1. Use the latest image from the official source, for example ubuntu.com/download/desktop for Ubuntu, and write it again.
2. Pick the UEFI entry in the boot menu if the stick is listed twice.
3. Check the image supports Secure Boot, in its own documentation.
4. Try another PC, if you have one. If it starts there, the stick is fine and the first PC is the stricter one.
5. Look for a gentler firmware option before switching Secure Boot off: for example, a setting to allow third-party or Microsoft UEFI CA–signed software. The name varies by maker, and many PCs don’t have one.

Before you change any firmware settings

• Write down every setting you change, and what it was before.
• Understand the trade-off. While Secure Boot is off, the PC will start software nobody has vouched for, and that includes malicious software. Turning it off to try a stick you made yourself, from an official download, is a small, temporary risk. Leaving it off is not something we’d recommend.

If you decide to turn it off temporarily

1. Open the firmware settings. From Windows 11: Settings → System → Recovery → Advanced startup → Restart now, then Troubleshoot → Advanced options → UEFI Firmware Settings. Or press the setup key at power-on (often F2, F10, Del or Esc).
2. Find Secure Boot, usually under a Security or Boot tab, and set it to Disabled. Some PCs ask you to set a firmware (supervisor) password before they allow this.
3. Save, exit, and start from the stick using the boot menu.
4. When you’re finished, go back and turn Secure Boot on again, and put back anything else you changed. If Windows then asks for the BitLocker key, enter it.

Does DiskSnap need Secure Boot turned off?

No. Secure Boot has nothing to do with writing a USB stick. DiskSnap runs in Windows like any other program, and it copies an image onto the stick exactly as the image’s creator made it. Whether a particular PC agrees to start from that stick is between the image and the PC.