AnywhereUSB Manager on AlmaLinux / RHEL 9 with Secure Boot Enabled

Issue

AnywhereUSB Manager fails to function on AlmaLinux 9 (and other RHEL 9-based distributions) when Secure Boot is enabled. The required vhci_hcd kernel module is present but fails to load, producing the following error:

modprobe: ERROR: could not insert 'vhci_hcd': Key was rejected by service

The AnywhereUSB Manager log will show:

AnywhereUSB Manager: Error loading client driver, vhci-hcd driver not loaded, try: sudo modprobe vhci-hcd

Solution

The issue is not a Digi software defect and the Digi driver does not require Secure Boot to be disabled. The vhci_hcd module from ELRepo is correctly signed, but the ELRepo Secure Boot signing key has not been enrolled in the system's MOK (Machine Owner Key) database. Once the ELRepo key is trusted, the module loads normally and AnywhereUSB Manager functions with Secure Boot enabled.

Enroll the ELRepo Secure Boot key in your MOK setup:

1. Confirm the module is present but not loading: lsmod | grep vhci
2. Confirm Secure Boot is active and the key is being rejected: dmesg | grep -i -e secure -e mok -e module -e vhci
3. Check which keys are currently enrolled: mokutil --list-enrolled
4. Verify the running kernel matches the module's vermagic field: modinfo vhci-hcd
5. If the ELRepo key is not listed in enrolled keys, import it into MOK: sudo mokutil --import /etc/pki/elrepo/RPM-GPG-KEY-elrepo.org
6. Reboot and follow the UEFI/MOK Manager prompts to complete key enrollment.
7. After reboot, confirm the module loads: lsmod | grep vhci
8. Confirm the AnywhereUSB Manager service is running: sudo systemctl status awusbmanager

• Digi does not require Secure Boot to be disabled. This is a system-level key trust configuration issue, not a Digi software limitation.
• The vhci_hcd module on RHEL/Rocky/AlmaLinux systems must be installed from ELRepo's kmod-usbip package, as noted in Digi documentation.
• If the running kernel version does not match the module's vermagic field, the module will also fail to load. Ensure both are in sync after any kernel update.
• The awusb.ini configuration file referenced in AnywhereUSB Manager logs is created automatically on first run. Its absence before initial launch is expected and not an error.
• If MOK enrollment is not possible in your environment, disabling Secure Boot will allow the module to load, but this is not the recommended approach.

Further Information

• AnywhereUSB Manager Linux Release Notes (tested distributions): https://hub.digi.com/dp/path=/support/asset/anywhereusb-manager-linux-release-notes-1.3/
• ELRepo Project: https://elrepo.org
• Linux kernel lockdown documentation: man kernel_lockdown.7