Newly installed SLES 15 SP doesn't boot with Secure Boot enabled

SUSE Linux Enterprise Server 15 SP6

SUSE Linux Enterprise Server 15 SP5

After installing SLES15 SP5 or SP6 on a system that supports Secure Boot and this is enabled, the system isn't able to boot unless Secure Boot is disabled.

When checking the keys present in the UEFI utility, they key appears to have been expired.

It may be necessary to import and enroll the latest SUSE Secure Boot Signing CA and SUSE Secure Boot Signing Key with mokutil.

1. Obtain those two necessary keys from:

https://www.suse.com/support/security/keys/

2. Convert the keys from .crt to .der format:

 openssl x509 -outform der -in suse_secure_boot.crt -out suse_secure_boot.der

3. Use the mokutil utility to import, set password and finally, enroll the keys:

 In a terminal, as root, import the .der keys:

 mokutil --import XXX.der

 Set the password that will be used to enroll the key in the MokUtil utility  upon reboot before UEFI runs:

 mokutil --password

 After rebooting, please check the key has been enrolled with:

 mokutil --list-enrolled

The system should now be able to boot with Secure Boot enabled and the latest SUSE keys enrolled.

The SUSE keys present in UEFI, possibly provided by the hardware vendor, have expired.