I spent the whole night, testing several installation, mokutil and efibootmgr.
But grub does not load when secure boot is enabled (I am stuck on the EFI boot device selection and cannot load the disk).
I am surprised that at no moment, I got the shim dialog after reboot to confirm a certificate enrollment. I would expect that as it is how it worked in my previous Fedora and openSUSE installations.
However, there is an ubuntu certificate that looks correct:
% efibootmgr -v BootCurrent: 001A Timeout: 2 seconds BootOrder: 001A,0017,0018,0019,001B,001C,0021 Boot0000* Fedora HD(1,GPT,9e081e7e-e008-413e-b738-5b7e1b22a95a,0x800,0x64000)/File(\EFI\fedora\shim.efi) Boot0001* Fedora HD(1,GPT,9f92cb1b-1114-49a3-9711-f73417ae5bf5,0x800,0x64000)/File(\EFI\fedora\shim.efi) Boot0002* ubuntu HD(1,GPT,32efde20-a294-468c-a7fc-44e9b179f135,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Any suggestion? (other than disable secure boot please, it is mandatory for my work)
I also have a more specific question that would help me in my research: is the shim/grub environment tweaked by Elementary or is it stock Ubuntu stuff?