// Module included in the following assemblies:
//
// * hardware_enablement/kmm-kernel-module-management.adoc

:_mod-docs-content-type: CONCEPT
[id="kmm-using-signing-with-kmm_{context}"]
= Using signing with Kernel Module Management (KMM)

[role="_abstract"]
On Secure Boot-enabled {product-title} systems, out-of-tree kernel modules must be signed with keys enrolled in the Machine Owner's Key (MOK) database. For kernel modules built out of tree, KMM supports signing kmods through the `sign` section of the kernel mapping in a `Module` custom resource.

For more details on using Secure Boot, see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/managing_monitoring_and_updating_the_kernel/signing-a-kernel-and-modules-for-secure-boot_managing-monitoring-and-updating-the-kernel#generating-a-public-and-private-key-pair_signing-a-kernel-and-modules-for-secure-boot[Generating a public and private key pair]

[id="kmm-using-signing-with-kmm-prerequisites_{context}"]
== Prerequisites

* A public private key pair in the correct (DER) format.
* At least one secure-boot enabled node with the public key enrolled in its MOK database.
* Either a pre-built driver container image, or the source code and Dockerfile needed to build one in-cluster.
