UEFI SecureBoot模式下PXE启动失败问题求助

大家好，我最近在配置PXE网络启动时遇到了一个棘手的问题：

UEFI模式下PXE能正常启动，但开启SecureBoot后就会直接报错：

Boot failed. EFI Network. Failed Secure Boot Verification.

我已经做了不少排查尝试，具体情况如下：

• 首先检查了TFTP根目录下的bootx64.efi签名情况，用sbverify --list bootx64.efi命令验证，结果显示它带有微软的合法签名证书，输出内容如下：

root@hostname:/var/lib/tftpboot# sbverify --list bootx64.efi

warning: data remaining[830784 vs 955656]: gaps between PE/COFF sections?

signature 1

image signature issuers:

- /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011

image signature certificates:

- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows UEFI Driver Publisher

issuer:  /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011

- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011

issuer:  /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation Third Party Marketplace Root

• 我还尝试过用自己生成的密钥重新签名bootx64.efi，按照SecureBoot签名的标准流程操作过，但依然没能解决问题。

• 另外也试过替换成shim-signed包中的grubnetx64.efi.dualsigned（重命名为bootx64.efi），这个文件同时带有微软和Canonical的双重签名，验证结果如下：

root@hostname:/var/lib/tftpboot# sbverify --list bootx64.efi

warning: data remaining[836848 vs 962400]: gaps between PE/COFF sections?

signature 1

image signature issuers:

- /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master Certificate Authority

image signature certificates:

- subject: /C=GB/ST=Isle of Man/O=Canonical Ltd./OU=Secure Boot/CN=Canonical Ltd. Secure Boot Signing (2022 v1)

issuer:  /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master Certificate Authority

signature 2

image signature issuers:

- /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011

image signature certificates:

- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows UEFI Driver Publisher

issuer:  /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011

- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011

issuer:  /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation Third Party Marketplace Root

目前的奇怪现象是：开启SecureBoot后，客户端只会从TFTP服务器请求bootx64.efi，之后就没有后续动作了——既不会下载grubx64.efi，也进不了GRUB菜单。但只要关闭SecureBoot，整个流程就完全正常，能顺利下载grub/grub.cfg并加载PXE镜像。

我希望能在保持SecureBoot开启的前提下实现PXE启动，不想让用户为了网络启动特意关闭这个安全功能。但现在找到的大部分教程都是针对单台机器的SecureBoot配置，很难直接适配网络启动的场景，所以想请教各位大佬，有没有可行的解决方案或者排查方向？

备注：内容来源于stack exchange，提问作者Scott