Was configuration for secure boot removed from Autoyast intentionally? In SLES11, the tag off in the bootloader section allowed for secure boot to be set to off. This does not work in SLES12 SP3. It seems not possible to install SLES12 SP3 using autoyast and secure boot off. The reference autoinst.xml file created from a standard installation that has secureboot off will still build a new system with secureboot on. The efibootmgr boot option will always be labeled ‘sles-secureboot’ and points to \EFI\sles\shim.efi instead of the label ‘sles’ with \EFI\sles\grubx64.efi that I want.
More info…after installation using autoyast, ‘mokutil --sb-state’ will indicate secure boot is off (in my case the hardware does not have secure boot enabled). However, the yast2 bootloader will show secure boot support is enabled. If you remove that selection and save, the correct bootloader (grubx64.efi) is installed and the boot entry will now be ‘sles’. Think this is a bug and autoyast should capture and restore the desired state of yast2 bootloader secure boot support.