RedHat Shim rejects binary signed with enrolled MOK certificate

[papst]

I'm working on making the bootloader of my BSD-like kernel compatible with UEFI Secure Boot. According to the OSDev Wiki, one way to avoid obtaining a Microsoft-signed certificate is to use Red Hat's shim, which is already signed by Microsoft and allows loading another EFI binary signed with a Machine Owner Key (MOK).

From the Fedora repositories I downloaded a signed shim binary and extracted both mmx64.efi (MokManager) and shimx64.efi (the actual shim). I renamed shimx64.efi to bootx64.efi and placed both files in /efi/boot. Since shim looks for an EFI binary named "grubx64.efi", I renamed my bootloader accordingly.

Next, I generated a key pair for MOK enrollment:

Code: Select all

openssl req -new -x509 -newkey rsa:2048 -keyout MOK.key -out MOK.crt -days 3650 -nodes

Then I signed my bootloader:

Code: Select all

sbsign --key MOK.key --cert MOK.crt --output grubx64.efi grubx64.efi

Finally, I converted the certificate to DER format:

Code: Select all

openssl x509 -in MOK.crt -outform DER -out MOK.der

On boot I receive a Secure Boot violation (expected since MOK List doesn't have my certificate loaded just yet), after which MokManager launches. I enroll the certificate and reboot, but I get:

Code: Select all

Verification failed: (0x1A) Security Violation

To confirm the key was enrolled, I booted Fedora and checked the MOK list, where my certificate does appear.

At this point, I'm unsure whether my approach even works or if I'm missing a step...

Any help would be greatly appreciated.

[papst]

For anyone encountering the same issue in the future: In newer Shim versions you need to add a new section, named ".sbat" to the PE, which should ideally be empty.