Great, I made it. Created my own MOK key in Fedora:
$ sudo certutil -d /etc/pki/pesign -L
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Secure Boot Signing Key Pu,Pu,Pu
Steps:
openssl req -config ./MOK.cnf -new -x509 -newkey rsa:4096 -nodes \
-days 36500 -outform DER -keyout "MOK.priv" -out "MOK.der"
sudo certutil -A -i MOK.der -n "Secure Boot Signing Key" -d /etc/pki/pesign/ -t "Pu,Pu,Pu"
sudo openssl pkcs12 -export -out MOK.p12 -inkey MOK.priv -in MOK.der
sudo pk12util -i MOK.p12 -d /etc/pki/pesign
And yeah obviously you also want to do:
sudo mokutil --import MOK.der