Secure Boot

ELI5 — The Vibe Check

Secure Boot verifies that every piece of software that loads during startup is signed and trusted. Bootloader? Signed. Kernel? Signed. Drivers? Signed. If anything was tampered with, the machine refuses to boot. It's like checking the ID of every person entering through the back door, in order, before the building opens.

Real Talk

Secure Boot is a UEFI firmware feature that ensures only cryptographically signed boot software runs during startup. It maintains a database of trusted certificates and checks each boot component (bootloader, kernel, drivers) against it. This prevents boot-level malware (rootkits, bootkits) from loading before the OS security mechanisms activate.

When You'll Hear This

"Secure Boot prevents rootkits from loading before the OS starts." / "Disable Secure Boot if you need to boot a custom kernel — but know the security tradeoff."