I think you can follow below process :
- Generate keys for your system . A known good process to me is this
- Now you can sign your shim.efi with this signature. use pesign for signing as mentioned in the given link
- Now it should work, if not then you might have to sign other binaries with new signatures as well.
But I am afraid that removing MS certificate from shim.efi might break. You might be interested in reading this link for more details.
I have taken few points below for your reference :
A lot of our users want to build their own kernels. Some even want to
build their own distributions. Signing our bootloader and kernel is an
impediment to that. We'll be providing all the tools we use for
signing our binaries, but for obvious reasons we can't hand out our
keys. There's three approaches here. The first is for a user to
generate their own key and enrol it in their system firmware. We'll
trust anything that's signed with a key that's present in the
firmware. The second is to rebuild the shim loader with their own key
installed and then pay $99 and sign that with Microsoft. That means
that they'll be able to give copies to anyone else and let them
install it without any fiddling. The third is to just disable secure
boot entirely, at which point the machine should return to granting
the same set of freedoms as it currently does.
A system in custom mode should allow you to delete all existing keys
and replace them with your own. After that it's just a matter of
re-signing the Fedora bootloader (like I said, we'll be providing
tools and documentation for that) and you'll have a computer that will
boot Fedora but which will refuse to boot any Microsoft code. It may
be a little more awkward for desktops because you may have to handle
the Microsoft-signed UEFI drivers on your graphics and network cards,
but this is also solvable. I'm looking at ways to implement a tool to
allow you to automatically whitelist the installed drivers. Barring
firmware backdoors, it's possible to configure secure boot such that
your computer will only run software you trust. Freedom means being
allowed to run the software you want to run, but it also means being
able to choose the software you don't want to run.