Fresh install and secure boot not working on a Thinkpad

Question

I spent the whole night, testing several installation, mokutil and efibootmgr.

But grub does not load when secure boot is enabled (I am stuck on the EFI boot device selection and cannot load the disk).

I am surprised that at no moment, I got the shim dialog after reboot to confirm a certificate enrollment. I would expect that as it is how it worked in my previous Fedora and openSUSE installations.

However, there is an ubuntu certificate that looks correct:

% efibootmgr -v
BootCurrent: 001A
Timeout: 2 seconds
BootOrder: 001A,0017,0018,0019,001B,001C,0021
Boot0000* Fedora    HD(1,GPT,9e081e7e-e008-413e-b738-5b7e1b22a95a,0x800,0x64000)/File(\EFI\fedora\shim.efi)
Boot0001* Fedora    HD(1,GPT,9f92cb1b-1114-49a3-9711-f73417ae5bf5,0x800,0x64000)/File(\EFI\fedora\shim.efi)
Boot0002* ubuntu    HD(1,GPT,32efde20-a294-468c-a7fc-44e9b179f135,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)

Any suggestion? (other than disable secure boot please, it is mandatory for my work)

I also have a more specific question that would help me in my research: is the shim/grub environment tweaked by Elementary or is it stock Ubuntu stuff?

Answer 1

Answering to myself.

For some reason, /boot/efi/EFI had an ubuntu folder, but no BOOT folder.

I created this BOOT folder and copied all the content from ubuntu.

I also copied shimx64.efi to bootx64.efi (not sure if this step is required).

It looks like this now:

# ls /boot/efi/EFI/BOOT 
bootx64.efi*  grub.cfg*  grubx64.efi*  grubx64.efi.bak*  mmx64.efi*  shimx64.efi*

Why this stuff was done at install time and why efibootmgr failed to update boot order remain mysteries...