/usr/bin/cert-to-efi-hash-list

Usage: /usr/bin/cert-to-efi-hash-list [-g <guid>][-t <timestamp>][-s <hash>] <crt file> <efi sig list file>
Take an input X509 certificate (in PEM format) and convert it to an EFI
signature hash list file containing only that single certificate

Options:
	-g <guid>        Use <guid> as the owner of the signature. If this is not
	                 supplied, an all zero guid will be used
	-s <hash>        Use SHA<hash> hash algorithm (256, 384, 512)
	-t <timestamp>   Time of Revocation for hash signature
                   Set to 0 if not specified meaning revoke
                   for all time.