OSDev.org

I'm working on making the bootloader of my BSD-like kernel compatible with UEFI Secure Boot. According to the OSDev Wiki, one way to avoid obtaining a Microsoft-signed certificate is to use Red Hat's shim, which is already signed by Microsoft and allows loading another EFI binary signed with a Machine Owner Key (MOK).

From the Fedora repositories I downloaded a signed shim binary and extracted both mmx64.efi (MokManager) and shimx64.efi (the actual shim). I renamed shimx64.efi to bootx64.efi and placed both files in /efi/boot. Since shim looks for an EFI binary named "grubx64.efi", I renamed my bootloader accordingly.

Next, I generated a key pair for MOK enrollment:
Then I signed my bootloader:
Finally, I converted the certificate to DER format:
On boot I receive a Secure Boot violation (expected since MOK List doesn't have my certificate loaded just yet), after which MokManager launches. I enroll the certificate and reboot, but I get:
To confirm the key was enrolled, I booted Fedora and checked the MOK list, where my certificate does appear.

At this point, I'm unsure whether my approach even works or if I'm missing a step...

Any help would be greatly appreciated.

For anyone encountering the same issue in the future: In newer Shim versions you need to add a new section, named ".sbat" to the PE, which should ideally be empty.