This script retrieves and displays Secure Boot certificates and signatures (PK, KEK, DB, and DBX) from UEFI firmware and optionally saves them to files. The DBX (forbidden signatures) database contains both certificates and hashes that are blocked by Secure Boot.

Secure Boot and UEFI configuration audit toolkit — boot chain verification, DBX updates, boot policy, and firmware security assessment