The blue Secure Boot screen

When Secure Boot is on, the boot after you install stops on a blue screen. The live session does not show it. The title is Shim UEFI key management. The black bar is the choice. The down arrow moves it. Enter takes it. There is no mouse.

The password is universalblue. Nothing you type appears. The keyboard is English QWERTY.

Press a key

A blue screen titled Shim UEFI key management. The center says Press any key to perform MOK management. The corner says Booting in 10 seconds. — Press any key before the corner counts down to zero. If it boots on its own, the key is still waiting and this screen comes back next time.

Enroll MOK

A blue screen titled Perform MOK management. Continue boot is highlighted in black. The other rows are Enroll MOK, Enroll key from disk, and Enroll hash from disk. — Continue boot is highlighted. Leave it. Press the down arrow once, so Enroll MOK is highlighted, and press Enter.

Continue

A blue screen titled [Enroll MOK]. View key 0 is highlighted in black. Continue is the other row. — View key 0 is highlighted. You can open it and come back. Press the down arrow so Continue is highlighted, and press Enter.

Yes

A blue screen titled Enroll the key(s)?. No is highlighted in black. Yes is the other row. — No is highlighted. Press the down arrow so Yes is highlighted, and press Enter. Enter on No leaves the key unenrolled.

The password

A blue screen with a small box that says Password:. — Type universalblue and press Enter. The letters do not appear. A wrong password says Password doesn't match. After three wrong tries, the blue screen comes back on the next boot.

Reboot

A blue screen titled Perform MOK management. Reboot is highlighted in black. The other rows are Enroll key from disk and Enroll hash from disk. — Reboot is highlighted. Enroll MOK is gone. Press Enter. The computer restarts, and the key is enrolled.