09-17-2021, 07:19 AM
You can have ENROLL_THIS_KEY_IN_MOKMANAGER.cer as a seperate file.
But this file is just for shim not the UEFI BIOS.
The shim is already signed with a valid signature and the shim will check the grub.efi.
For the first time, shim check grub.efi fail, so it will start the mokmanager screen for user to enroll the cer file.
After that, the second boot time, shim will check OK then start grub.efi.
Anyway, the EFI\BOOT\BOOTX64.efi is the shim and is signed with a valid key(because the shim is directly get from fedora/redhat distro)
So I don't known why your UEFI BIOS still report "- secure boot violation, invalid signature detected."
But this file is just for shim not the UEFI BIOS.
The shim is already signed with a valid signature and the shim will check the grub.efi.
For the first time, shim check grub.efi fail, so it will start the mokmanager screen for user to enroll the cer file.
After that, the second boot time, shim will check OK then start grub.efi.
Anyway, the EFI\BOOT\BOOTX64.efi is the shim and is signed with a valid key(because the shim is directly get from fedora/redhat distro)
So I don't known why your UEFI BIOS still report "- secure boot violation, invalid signature detected."