Hi - I think you need to enable the 3rd party certificate in the BIOS. You can do this from the BIOS setup screen (F1 during early boot).
Details here if interested: https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure_Boot_for_Linux_Secured-core_PCs.pdf