Why does openSUSE sporadically prompt during boot to trust its built-in certificate?

Question

The conundrum

My wife’s laptop has been running openSUSE Leap 15.0 for several years, and she has once or twice been flummoxed by this prompt at the very beginning of the boot sequence, most recently this morning:

Trust openSUSE Certificate

Do you agree to use the built-in openSUSE certificate to verify boot loaders and kernels?

This unusual behaviour has worried her, and left her uncertain how to proceed (especially as she could not use the mouse or most of the keyboard). The system appeared to boot quite normally when I selected Yes.

I should like to know why this happens, and particularly if it could be a sign of a security problem.

The system

The system (openSUSE Leap 15.0) has been in almost daily use for several years with frequent reboots without the above prompt; it has not been changed recently apart from installing updates, none of which I believe were installed since the previous boot. (I ought to get round to updating to a new version of Suse, but that is another matter!)

Sources consulted

I searched for the above prompt and found nothing that helped me much. I looked at:

• SUSE and Secure Boot: The Details, a 2012 description of the boot process. This includes the following, which reassures me somewhat by describing a built-in key and possibility to override it, but does not explain the sporadic appearance of the prompt:

The shim then goes on to verify that the GRUB2 bootloader it wants to load is trusted. It will not use the SUSE KEK¹ nor the Microsoft cert for this. In a default situation the shim will use an independent SUSE certificate embedded in its body. In addition, the shim will allow to “Enroll” additional keys, overriding the default SUSE key. Let’s call them “Machine Owner Keys” or MOKs for short.

¹ _{Key Exchange Key “The Platform Key (PK) allows almost everything. The Key Exchange Key (KEK) allows all a PK can except changing the PK.”}

• This question in the Unix & Linux community. That includes the prompt but seems to have little bearing on our problem, being about subsequent problems getting an image to boot.

• ‘BootHole’ Secure Boot Threat Found In Most Every Linux Distro, Windows 8 And 10, at Forbes.com describing security problems in GRUB. This sounds scary at first, but I do not think it is relevant. After all, malware would hardly want to ask the user’s permission!

Answer 1

This is related to UEFI boot security. According to the OpenSUSE wiki, this should happen at first boot:

For the very first time of loading openSUSE 'shim', it asks the user if the openSUSE certificate built in 'shim' is trusted to verify grub2 and linux kernels.

So this should happen only once. There was a recent security bug regarding UEFI boot security that may have triggered a refresh of the shim; this might have caused the message.