loading kernel with secure boot

[NiKiZe]

How did you sign the efi build of iPXE?
is kernel and iPXE signed by different keys, or the same?

iPXE just sends the binary to the EFI firmware which does the verification, so it must be that the firmware somehow denies this.
I also think that this can be seen in the error code returned - could you please post the _full_ error message you get from iPXE (this includes the ipxe.org url) please make sure you post the message - and not the resulted redirected url.