Anyway, I followed the age-old procedure of creating a bootable ... the secureboot-certs install command. With Citrix drivers ...