icedterminal

Sorry for delay.

Install sbsigntool

Create Certificate:

openssl x509 -outform der -in cacert.pem -out certificate.crt

The resulting certificate.crt is what will be used to verify the signature of the EFI binary. You will import this into the motherboards firmware database.

Sign EFI Binary:

sbsign --key cakey.pem --cert cacert.pem bootx64.efi --output BOOTX64.efi

After you sign the boot file, reboot into the firmware and import the certificate. Reboot normally and secure boot should work without issue.

Secure boot will fail validation. You can still boot it anyway by disabling secure boot. You just lose a layer of security. You can manually sign boot files yourself and add the relevant certificate to the motherboard firmware database. Assuming it lets you.