While trying to setup secureboot in custom Debian based system, grub is not loading if SB is on. I'm using shim (signed by MS) as first stage bootloader. Now I plan to use MOK to sign grub2 and kernels. So the steps are:
Create priv and public key. Public key is in .der and .pem formats.
grub-mkstandalone --format x86_64-efi /boot/grub/grub.efi -o grub.efi.unsigned
sbsign --key ~/my.priv --cert ~/my.pem grub.efi.unsigned --output grub.efi
cp grub.efi /boot/efi/EFI/mylinux/grubx64.efi
mokutil --import my.der
Reboot and enroll the key in MOK management
Enable secureboot in UEFI settings and boot.
So what happens is shim gets loaded, but as it starts grub, it refuses to load module normal.mod with and error
Secureboot forbids to load module (memdisk)/boot/grub/x86_64-efi/normal.mod. It drops to grub rescue shell.
So my question is if this problem is with MOK keys not loading properly? So I tested with the stock grub signed from Debian, signed by their key, trusted by shim. Then grub boot fine but ofc stops not finding config file. I can manually add that and boot. Signature verification is not enforced in grub settings. So Debian keys load fine.
My next doubt is something wrong with the procedure of creating grub. I read stuffs from SE, Debian and arch wiki etc, couldn't find any working solution.
Any insight is deeply appreciated.