secure boot can not accept ENROLL....CER

[mlonga]

thinkpad x240s latest bois version
choiced secure boot and create ventoy udisk.
followed UEFI mode secure boot operation description (UEFI模式安全启动操作说明)
when i move to select key step. and select ENROLL_THIS_KEY_IN_MOKMANAGER.cer.
the system shows "Unsupported Format"
It says "Only Der encoded certificate(*.cer/der/crt) is supported"

what can i do?

enroll a hash from a file in the EFI folder (it works for me with grubx64.efi but i think it would work with any of them)