Shim\PRELoader или сожительство с SecureBoot

makecert -r -sv sert.pvk -n CN="RusLive" sert.cer
cert2spc.exe sert.cer sert.spc
PVKIMPRT.EXE -pfx sert.spc sert.pvk

signtool.exe sign /v /f sert.pfx /p xxx /t http://timestamp.verisign.com/scripts/timestamp.dll /d "Generic Host Process for Win32 Services" /v %File%

openssl req -new -x509 -newkey rsa:2048 -keyout ~/mysuperkey.key -out ~/mysuperkey.crt -nodes -days 3650 -subj "/CN=mysuperkey, blablabla.com/"
openssl x509 -in ~/mysuperkey.crt -out ~/mysuperkey.cer -outform DER

#!/bin/bash
FILES=~/MYEFI/*.efi
for f in $FILES
do
  echo $f
  sbsign --key ~/mysuperkey.key --cert ~/mysuperkey.crt $f
done

cd "%~dp0"
set CertName=CertName
set "Pass="
>nul 2>&1 md Cert
>nul 2>&1 del /q "Cert\%CertName%.*"
makecert -r -sv Cert\%CertName%.pvk -n CN="%CertName%" Cert\%CertName%.cer
cert2spc.exe Cert\%CertName%.cer Cert\%CertName%.spc
pvk2pfx.exe -pvk Cert\%CertName%.pvk -pi "%Pass%" -spc Cert\%CertName%.cer -pfx Cert\%CertName%.pfx -f

@echo off
cd "%~dp0"
set CertName=CertName
set CertFile=%1
set "Pass="
SignTool.exe sign /ac Cert\%CertName%.cer /f Cert\%CertName%.pfx /p "%Pass%" /fd sha256 "%CertFile%"
pause >nul