[ubuntu-hardened] Secure boot certificates

[James Wilson]

Where can I find copies of the certificates used by Canonical's secure 
boot setup? I want to roll my own PK, KEK, and db lists and need the 
certificates in PEM or DER form.

Specifically, I am looking for the two certificates in the following 
chain on the bootloader:

% sudo sbverify --list /boot/efi/EFI/BOOT/BOOTX64.EFI
signature 1
image signature issuers:
  - /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. 
Master Certificate Authority
image signature certificates:
  - subject: /C=GB/ST=Isle of Man/O=Canonical Ltd./OU=Secure 
Boot/CN=Canonical Ltd. Secure Boot Signing (2017)
    issuer:  /C=GB/ST=Isle of Man/L=Douglas/O=Canonical 
Ltd./CN=Canonical Ltd. Master Certificate Authority