> For the complete documentation index, see [llms.txt](https://neupokoev-n.gitbook.io/pxe-boot/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://neupokoev-n.gitbook.io/pxe-boot/troubleshooting/invalid-dos-header-magic.md).

# Invalid DOS header magic

Happens when you try to sign not EFI file. For example doing this

```
sbsign --key MOK.key --cert MOK.crt --output bzImage.efi.signed bzImage
```

To sign a kernel you need the kernel to be build with a special option `CONFIG_EFI_STUB` <https://www.kernel.org/doc/html/latest/admin-guide/efi-stub.html>. As a result kernel is built with different name: `bzImage.efi`.

## Reference

* <https://unix.stackexchange.com/questions/596455/cryptic-error-when-attempted-to-sign-kernel-modules>
* <https://bentley.link/secureboot/>
* <https://www.wzdftpd.net/blog/tag/uefi.html>

Now I have an answer <https://github.com/rhboot/pesign/issues/64>