I'm trying to get my dual boot (Arch+Win10) to work with Secure Boot. I followed the Arch Wiki, with the following steps.
sudo mount /dev/sda1 /boot/efi sudo mv /boot/efi/EFI/Boot/bootx64.efi /boot/efi/EFI/Boot/grubx64.efi sudo cp /usr/share/shim-signed/shimx64.efi /boot/efi/EFI/Boot/bootx64.efi sudo cp /usr/share/shim-signed/mmx64.efi /boot/efi/EFI/Boot/ sudo openssl req -newkey rsa:2048 -nodes -keyout MOK.key -new -x509 -sha256 -days 3650 -subj "/CN=MOK_LENOVO_MASSIMO/" -out MOK.crt sudo openssl x509 -outform DER -in MOK.crt -out MOK.cer sudo openssl x509 -outform DER -in MOK.crt -out MOK.cer sudo sbsign --key MOK.key --cert MOK.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux sudo sbsign --key MOK.key --cert MOK.crt --output /boot/efi/EFI/BOOT/grubx64.efi /boot/efi/EFI/BOOT/grubx64.efi sudo cp MOK.cer /boot/efi/EFI/ systemctl reboot --firmware-setup
As I enabled Secure Boot the system booted direclty into windows (which is after the new "shim" bootx64.efi, still called "rEFInd Boot Manager", in the boot order).
Disabling SB got me to a working refind again, which, I guess, means that shim is properly configured, but the system does not reckognize its signed key? The Wiki and the refind site tell me I should be prompted with MOK tool, since Shim, signed with Microsoft key, can't chainload (a not yet signed) refind.
How do I make shim chainload MokManager?
EDIT: I had a look at the Shim source code and indeed it seems that, if there were errors, shim would print them happily (which doesn't happen). It just silently boot windows.