# Why NVIDIA driver installation fails on Ubuntu, and how to fix it

> Source: https://netray.co/troubleshoot/nvidia-driver-install-ubuntu-failed
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: On-Prem AI Troubleshooting

## Short answer

The single most common reason NVIDIA driver installation fails on Ubuntu is Secure Boot rejecting the unsigned or self-signed kernel module at load time, since most machines now ship with Secure Boot enabled out of the box. The fix is enrolling the MOK key the installer generates, or disabling Secure Boot in the BIOS, then clearing any lingering nouveau or mixed-install conflicts before rebooting.

## Error Title

NVIDIA driver installation fails on Ubuntu

## Error Signature

modprobe: ERROR: could not insert 'nvidia': Key was rejected by service

## Alternate Signatures

- Failed to load module nvidia (module not found)
- dpkg: error processing package nvidia-driver-535 (--configure)

## Category

installation

## Stack

- nvidia-driver

## Affects

Fresh Ubuntu installs on hardware shipped with Secure Boot enabled by default, and any machine mixing apt-installed and runfile-installed NVIDIA drivers.

## Quick Fix

### Fastest path to a working driver install

**Steps:**

- Check Secure Boot status: mokutil --sb-state. If enabled, this is very likely your root cause.
- Purge any previous partial or conflicting driver install: sudo apt purge '^nvidia-.*' before reinstalling cleanly.
- Blacklist nouveau and update the initramfs so it does not conflict with the new driver.
- Install the recommended driver: sudo ubuntu-drivers autoinstall, or a specific version with sudo apt install nvidia-driver-550.
- Reboot, and if prompted by Secure Boot MOK enrollment, complete it with the password you set during install.
- Verify with nvidia-smi after reboot.

## Symptoms

- modprobe error stating the nvidia module key was rejected by the service
- dpkg reports an error configuring the nvidia-driver package during install
- nvidia-smi fails immediately after what appeared to be a successful apt install
- Ubuntu boots into a low-resolution fallback graphics mode after driver install

## Causes

### Secure Boot is enabled and rejects the unsigned kernel module

**Likelihood:** most-common

**Explanation:** Most Ubuntu installs since recent LTS releases enable UEFI Secure Boot by default. The NVIDIA driver installer generates its own MOK (Machine Owner Key) to self-sign the kernel module, but this key must be explicitly enrolled into the firmware's trusted key database through a reboot-time prompt. Skipping or missing that prompt leaves the module permanently rejected on every subsequent load attempt.

**Fix:** Run mokutil --import to enroll the MOK key generated during driver install, reboot, and complete the blue MOK Manager enrollment screen using the password you set, or disable Secure Boot in the BIOS if acceptable for your environment.

**Commands:**

- mokutil --sb-state
- sudo mokutil --import /var/lib/shim-signed/mok/MOK.der
- sudo reboot

### The nouveau open-source driver is still loaded and conflicting

**Likelihood:** common

**Explanation:** Ubuntu loads nouveau by default for basic display output before any proprietary driver is installed. If the blacklist and initramfs rebuild steps are skipped or done in the wrong order relative to the driver install, nouveau can still claim the GPU device at boot, preventing the new nvidia module from binding to the hardware.

**Fix:** Blacklist nouveau explicitly and rebuild the initramfs before rebooting, rather than relying on the driver installer to handle this automatically.

**Commands:**

- echo 'blacklist nouveau' | sudo tee /etc/modprobe.d/blacklist-nouveau.conf
- echo 'options nouveau modeset=0' | sudo tee -a /etc/modprobe.d/blacklist-nouveau.conf
- sudo update-initramfs -u

### Kernel headers missing or mismatched, so DKMS cannot build the module

**Likelihood:** common

**Explanation:** The NVIDIA driver package relies on DKMS to compile the kernel module against the exact running kernel's headers. If linux-headers for the currently running kernel are not installed, or a kernel update happened without a corresponding headers update, the DKMS build step fails silently or with a cryptic compiler error during dpkg configuration.

**Fix:** Install the exact matching headers package for your running kernel before installing or reinstalling the driver.

**Commands:**

- sudo apt install linux-headers-$(uname -r)
- sudo dkms autoinstall

### Mixing apt-based and runfile-based driver installation methods

**Likelihood:** occasional

**Explanation:** Some guides recommend the .run installer while others recommend apt; using both on the same machine, or switching methods without fully purging the previous install, leaves conflicting files, kernel module versions, and package manager state that neither installer fully cleans up, causing unpredictable configuration failures.

**Fix:** Pick one installation method (apt is generally easier to maintain and update on Ubuntu) and fully purge any remnants of the other before reinstalling from scratch.

**Commands:**

- sudo apt purge '^nvidia-.*'
- sudo apt autoremove

### Driver version does not yet support a very new kernel

**Likelihood:** rare

**Explanation:** Immediately after a new Ubuntu release or a bleeding-edge kernel upgrade, the NVIDIA driver's DKMS build scripts may not yet have compatibility patches for that kernel's internal API changes, causing the module build to fail with kernel-symbol-related compiler errors regardless of headers being correctly installed.

**Fix:** Check NVIDIA's release notes or community reports for known kernel compatibility issues, and either pin to an older, well-supported kernel temporarily or wait for a driver point release that adds support.

## Diagnostics

### Check Secure Boot state first

**Command:** mokutil --sb-state

**Interpretation:** SecureBoot enabled combined with a rejected key error is the most common root cause; if disabled, look elsewhere for the failure.

### Check the kernel log for the specific module load rejection reason

**Command:** dmesg | grep -i nvidia

**Interpretation:** Look for 'Key was rejected' (Secure Boot), 'Unknown symbol' (kernel headers mismatch), or no mention at all (module never attempted to load, likely nouveau conflict).

### Confirm nouveau is not still bound to the GPU

**Command:** lsmod | grep nouveau

**Interpretation:** Any output means nouveau is loaded and must be blacklisted with an initramfs rebuild before the nvidia module can take over the device.

### Confirm kernel headers match the running kernel exactly

**Command:** dpkg -l | grep linux-headers-$(uname -r)

**Interpretation:** No matching line means DKMS cannot build the module for the currently running kernel; install the exact matching headers package.

## Prevention

- Bake Secure Boot MOK enrollment and driver installation into your golden image so new machines never hit this manually.
- Standardize on one installation method (apt) across your fleet rather than mixing apt and runfile installs.
- Pin kernel and driver versions together, and test any kernel upgrade on a canary machine before rolling it out fleet-wide.
- Document your organization's Secure Boot policy so new engineers are not surprised by the MOK enrollment step on first setup.

## When To Escalate

If this happens across every new machine in a rollout, or your security policy mandates Secure Boot in a way that complicates unsigned module workarounds, treat it as a provisioning and imaging problem to solve once centrally rather than a recurring per-machine fix.

## Faq

### Why does my NVIDIA driver install fail specifically on Ubuntu but not other distros?

**Answer:** It is not unique to Ubuntu; any distro with Secure Boot enabled by default and no automatic MOK enrollment flow hits the same class of failure. Ubuntu is simply the most common distro engineers hit this on because it enables Secure Boot out of the box on most fresh installs and desktop images.

### What is a MOK key and why do I need to enroll it?

**Answer:** MOK stands for Machine Owner Key. Since the proprietary NVIDIA driver is not signed by a key Microsoft or the distro trusts by default, the installer generates its own key and self-signs the kernel module with it. Secure Boot only allows this module to load once you explicitly enroll that key into the firmware's trusted database, which requires a reboot-time confirmation step.

### Is it safe to just disable Secure Boot instead of enrolling the key?

**Answer:** For most workstations and lab machines, yes, disabling Secure Boot is a simpler and equally functional fix. In regulated or compliance-driven environments, however, Secure Boot is often a required control, in which case enrolling the MOK key is the correct approach since it preserves Secure Boot protection while allowing the signed driver module to load.

### I purged and reinstalled the driver and it still fails the same way. What next?

**Answer:** Check dmesg immediately after the failed load attempt rather than repeating the purge-and-reinstall cycle. The specific rejection reason in the kernel log, whether it names Secure Boot, an unknown symbol, or nouveau, tells you which of the underlying causes actually applies to your machine.

## Search terms

nvidia driver install failed ubuntu, modprobe key was rejected by service, nvidia driver secure boot ubuntu, dkms nvidia build failed, ubuntu-drivers autoinstall failed, nvidia driver dpkg error

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json