There is a problem on some machines, particulary laptops - They don't appear to have the "Microsoft Windows UEFI Driver Publisher" public key installed in their BIOS to allow the signed Ubuntu boot loader (and other UEFI software such as ours) to run with Secure Boot option enabled. This is NOT the same key, which Microsoft use to sign their own UEFI Windows Boot Manager and it appears that some BIOS implementations only have this Microsoft exclusive public key.
The solution is either:
For Microsoft to sign third party UEFI binaries with the SAME key as they use for their own bootloader.
For BIOS vendors/computer hardware motherboard manufacturers to be sure they include the data to allow "Microsoft Windows UEFI Driver Publisher" signed binaries to work correctly.
On a Windows 8 machine, enter
Mountvol Z: /S in an admin elevated command prompt box. Then in the command prompt do:
copy Z:\EFI\Microsoft\*.efi C:\test
Z is an unused drive letter.
You can then check in (already created)
C:\test folder the digital signatures on the Microsoft .efi files and see that the name of the key is different to the key they used to sign the Ubuntu boot loader.
The Ubuntu boot files can be found in X:\EFI\Boot where X is the CD drive letter.
This needs sorting out, and sorting quickly.
Our research indicates that of laptops tested so far, only ASUS laptops have the correct keys installed in their bios, but we haven't yet managed to check everyone. I am not mentioning here, the names of machines which won't work, but one is a similar name to the one which does!