secure boot can not accept ENROLL....CER

[jotis]

thinkpad x240s latest bois version
choiced secure boot and create ventoy udisk.
followed UEFI mode secure boot operation description (UEFI模式安全启动操作说明)
when i move to select key step. and select ENROLL_THIS_KEY_IN_MOKMANAGER.cer.
the system shows "Unsupported Format"
It says "Only Der encoded certificate(*.cer/der/crt) is supported"

what can i do?