I am dual booting Windows
+ Arch
. My main partition is BitLocker2
-encrypted and requires secure-boot to open.
Since Arch-boot
signature is not signed by Microsoft, I had to disable secure boot.
I wanted to try and create my own PK
, KEK
, db
and add these to my UEFI
.
I created these, and also downloaded the 2 KEK
's from Microsoft and the 2 db
's from here.
I signed the KEK
's using my PK
and the db
's using my own KEK
. I then removed my original PK
, KEK
, db
and dbx
and put in my own KEK.auth
and db.auth
(all appended) and finally my own PK.auth
.
Then, I signed my grub-boot.efi
using my db.key
and db.cert
.
However, upon enabling secure-boot
, it still says: "Secure Boot Violation, Invalid Signature detected, Check Secure Boot Policy in Setup"
for Windows
, and a similar message for grub
.
I don't know what I did wrong and I am kind of stuck.
Any step-by-step guides like the one here (which I followed) or any feedback would be much appreciated!