What were you trying to do that didn't work?

===> The customer is forced to use UEFI by security constrains. They need to store custom certificates in EFI i.e. for Oracle (see ACFS / AFD Secure Boot Configuration Doc ID 2416501.1 or Trendmicro AV or Symantec AV - as those kernel modules won´t get loaded (mokutil and shim). They are deploying really high number of servers daily and are replacing certificates currently via shim on console. 

What is the impact of this issue to you?
===> The requirement is for an automated  mechanism to replace the certificates in case of expiring or invalidation. As they deploy large number of servers daily, replacing the certificates manually takes a lot of their time.