CentOS 7: Failed to set MokListRT: Invalid Parameter

You know what makes me angry? My servers not booting. I encountered this error after an update and reboot of CentOS 7:

Failed to set MokListRT: Invalid Parameter
Something has gone seriously wrong: import_mok_state() failed:
Invalid Parameter

So here is how you fix it.

Firstly, we need a CentoOS 7 ISO with the version of something like 1708 or 1707. Here is an archive of all the CentOS 7 releases. Thanks to Alexander Zubkov for commenting about the issue with the latest ISO.


Either burn a new CentOS 7 disc, make a boot flash drive, or insert the install ISO to your VM. Boot from the disc and once the menu shows up select the following: Advanced -> Rescue -> Troubleshooting -> Rescue media -> and press 1 when prompted.

 

In the terminal you should now have, run the following commands:

chroot /mnt/sysimage
cd /boot/efi/EFI/centos
cp grubx64.efi shimx64.efi
exit
reboot

You should be able to reboot into CentOS now. However, we still need to exclude an Shim and Mokutil from updates (shim-x64-12-2.el7.x86_64).

 

In a root terminal, run the following.

echo 'exclude=shim*,mokutil*' >> /etc/yum.conf
yum update

You should be good to go now. If that does not work try copying CENTOS\GRUBX64.EFI over top of EFI\BOOTX64.EFI in your boot partition.

 

Another thing you can try is booting the Super Grub2 disk and booting  GRUBX64 directly, or try emergency mode.



About: Ryan Parker

I currently work as a system administrator for the local school district. I also have a side job helping small to medium business with their technology. One of my hobbies is building out infrastructures for myself, friends, and clients.


34 thoughts on “CentOS 7: Failed to set MokListRT: Invalid Parameter”

  1. Hi,
    I am having this problem on a MacBook Pro, but in my case there is no “grubx64.efi” in my “boot/efi/EFI/centos” directory. Can this be copied over from the rescue USB install media?

    1. Do you use rEFInd? And I’m not sure copying the efi from the USB would be the best idea. It could be possibly for you to chroot to the CentOS install from a live cd and run grub-install and grub-mkconfig again to see if that will change anything.

  2. This solved why a previously reliable server was just powering off at a reboot after updating CentOS 7. I thought I’d gotten hit with a hardware failure. Dell R310 was just powering off after going through all the normal UEFI startup stuff and failing to boot, showing this error screen for a couple seconds before powering right off. That wasn’t fun to discover, and it also didn’t put an error into the SEL so IPMI was of no help in solving this. Had to go hands on at the co-lo.

  3. Thank you! Suffered a 6 hour power outage and my Dell 410 refused to boot when the power came on. I used a Super Grub Disk to boot the server then followed these instructions and rebooted.

    Worked like a champ!

    1. I carry a flash drive with supergrub2disk on it, it is so useful. I am surprise that an R410 has that issue, my guess is they never tested the update.

  4. i’m stuck on this command “cp grubx64.efi shimx64.efi” with error message “No such file or directory”.
    did i miss something here?

    1. It looks like you didn’t cd into the efi directory. Try repeating that part. If you get the same error, ls the directory that you’re attempting the copy from and reply with the result.

    1. I haven’t researched the cause much, but I don’t believe it’s a hardware issue. It seems to happen on all types of hardware and on more distros than just CentOS.

    2. The issue is that older EFI’s have a limited space available to run a efi command, and the update makes changes to how the EFI is booted. it is something to do with secure boot and PKI. When the new command is run, the EFI hangs because it cant complete the command. I think the same thing is happening on the new freenas 11.2.

  5. I tried to boot from the latest ISO version 1810, it gets the same error booting from it, I could not enter recovery mode. Fortunately I had an older version 1708 which worked. I think this should be added to the article, important to know you need an older ISO.

    1. Everyone involved in running this site has been happy to hear that we’ve been able to help out! Glad this solved the problem for you.

  6. Nothing helped. I had to reinstall my centOS on a freenas VM. But the command echo ‘exclude=shim,mokutil’ >> /etc/yum.conf is pretty helpful.

    Thank you

Leave a Reply

Your email address will not be published. Required fields are marked *