How to compare secure boot keys stored in motherboard’s firmware database with the signed .efi files?

It’s a piece of cake to enable secure boot in a virtual machine, but I’m struggling to do the same with OpenSUSE on my 2012 vintage computer which refuses to boot in secure boot mode even in the standard configuration (with microsoft’s keys it seems). I’d like to troubleshoot the most critical part: Do the keys match between the firmware and the shim ? How to check that ?