Comment # 31 on bug 947816 from Mike Galbraith

> hm... I tried to build and install a self-signed SLE12-SP2 kernel on
> openSUSE 42.1. I found the result of loading kernel through kexec-file
> result that it doesn't like SLE12-SP2.
> 
> On SLE12-SP2, the self-signed kernel works fine to load through kexec-file.
> But on openSUSE 42.1, it already returns "Key was rejected by service" then
> I found this log in dmesg:
> 
> [    3.392659] PKCS7: Sig 1: X.509 chain contains auth-skid nonmatch (1->1)
> 
> The same kernel, the same signing process but it got different result on
> openSUSE with SLE12 SP2. I guess that it is about the pesign,  mozilla-nss
> or openssl.
> 
> Hi Mike, 
> 
> Did you see the same PKCS7 error message?

No, that's not in the journal.  (I whack it regularly though...)