Ubuntu
sbsigntool package

  1. Bug #1551629
  2. Comment #4

Comment 4 for bug 1551629

Revision history for this message
Safayet Ahmed (safayet-ahmed) wrote :

I believe I have run into similar problems in the past.

Note, in many cases, the UEFI firmware will not verify the GRUB binary itself, but will verify the SHIM against certificates in the UEFI databases. On a standard system, Ubuntu doesn't have their own cert in the UEFI key databases. The SHIM will verify the UBUNTU-signed GRUB image against certificates embedded in the SHIM itself.

Anyway, after seeing your post and doing some more searching I came across this:
https://git.kernel.org/cgit/linux/kernel/git/jejb/sbsigntools.git/log/

It appears that James Bottomley has some really recent code for sbsign up on kernel.org. I'm about to give it a shot myself and hope it fixes the problem.