# The blue screen at first start, explained

> Why most PCs show one key screen after installing WolOS, what each choice on it means, and why the password is boot.

Source: https://wolos.pages.dev/blog/the-blue-screen

Published 2026-11-01 by WolOS.

On most PCs, the first start after installing WolOS shows a plain blue screen. It looks like something went wrong. It did not: it is the one moment WolOS needs you to confirm that this computer may trust its own key.

## Where the screen comes from

Secure Boot lets the firmware start only code signed by a key it trusts. Almost every PC trusts Microsoft's keys, and Microsoft signs a small, widely reviewed first stage called shim. WolOS ships Fedora's signed build of it, unmodified, byte for byte. Shim then starts WolOS's own loader, but only if that loader is signed by a key shim trusts.

WolOS has no shared vendor key. Each computer makes its own key at install, so there is no single secret whose leak would unlock every WolOS computer. Shim has never seen that key before, so it asks you once, on the firmware's blue screen, whether to trust it.

## What to press

1. Press a key.
2. Choose **Enroll MOK**, then **Continue**, then **Yes**.
3. Type the password `boot`. Nothing shows while you type.
4. Choose **Reboot**.

That is all. The screen does not come back.

## Why the password is a fixed word

The password only proves that the person at the keyboard is the one who asked for the key during install. It is not a secret that protects anything after that moment: once the key is enrolled, the firmware's own Secure Boot protection is what counts. A short, fixed word that the installer can tell you beforehand beats a random one nobody wrote down.

## If you missed it

The screen waits for a while and then starts the computer anyway, without the key. WolOS notices and asks again at the next start. You can also run `wol boot enroll` and restart.

## Computers that skip it

If the firmware is in Setup Mode, WolOS enrolls its key directly next to Microsoft's and no screen appears. If Secure Boot is off and cannot use the shim path, WolOS starts unsigned and Settings says so plainly.