sign-kernel.sh

# Create the signing key. Run this only the first time:
sudo update-secureboot-policy --new-key
sudo update-secureboot-policy --enroll-key
cd /var/lib/shim-signed/mok
sudo openssl x509 -in MOK.der -inform DER -outform PEM -out MOK.pem

# Backup the unsigned kernel and replace it with a signed version. Run this each time you want to sign a kernel:
BACKUP_FOLDER=~/workspace/kernels
VERSION=5.3.1-050301-generic
KERNEL=vmlinuz-${VERSION}

cd /boot
sudo cp $KERNEL $BACKUP_FOLDER
sudo rm $KERNEL
sudo sbsign --key /var/lib/shim-signed/mok/MOK.priv --cert /var/lib/shim-signed/mok/MOK.pem $BACKUP_FOLDER/$KERNEL --output $KERNEL
sudo dpkg-reconfigure grub-pc