...
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Platform Key/" -keyout PK.key -out PK.crt -days 3650 -nodes -sha256
$ openssl x509 -in PK.crt -out PK.cer -outform DER
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Key Exchange Key/" -keyout KEK.key -out KEK.crt -days 3650 -nodes -sha256
$ openssl x509 -in KEK.crt -out KEK.cer -outform DER
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Database/" -keyout DB.key -out DB.crt -days 3650 -nodes -sha256
$ openssl x509 -in DB.crt -out DB.cer -outform DER
Choose an EFI application in your edk2 build aritfacts to do the test
$ sbsign --key DB.key --cert DB.crt --output EmptyApplication-Riscv.efi.signed EmptyApplication-Riscv.efi
...