Comment # 10 on bug 1123245 from Neil Rickert

>After two kernel updates the only way I can get a reliable boot is to use the second secure boot which disappears if secure boot is disabled.

This is confusing, because I do not see any "secure boot" entry in the output
that you show in comment #3 above.

It is also unclear what you mean by "secure boot is disabled".  You can disable
secure-boot in your BIOS (or UEFI firmware).  And that should not have any
effect on which boot entries are there.  You can also disable in Yast, which
probably does affect your boot entries.

I would suggest leaving secure boot enabled in Yast, but disabled in your BIOS.
 That's what will probably work best for you.

Your problem appears to be that you are using a stale boot entry with your UEFI
firmware, which no longer matches the installed grub2-efi.  When you use
secure-boot (as set in Yast bootloader), then the code used for the boot entry
is self-contained and will usually work even when it does not match the
installed "grub2-efi".

The more complete solution would be to update "grubx64.efi" in your EFI
partition, so that it is identical to "/boot/grub2/x86_64-efi/core.efi".  And
since you have two EFI partitions, with a "grubx64.efi" in both partitions, you
should update both of those.  And, to be clear, those files will be in a
directory with path "EFI/opensuse" (relative to the top of the EFI partition). 
If the same filename is found in other directories, that's probably from a
different linux version.