Cant't finish do-release-upgrade due to secure boot enabled

My mokutil --sb-state says secure boot enabled, I have previously setup secure boot, and manually signing WiFi driver every kernel upgrade.
Now i did do-release-upgrade and during grup upgrade it says "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
"Your system has UEFI Secure Boot enabled in firmeware and the follwing kernels presnt on your sysem are unsigned :
4.13.0-46 generic
These kernels cannot be verified under Secure Boot" - what is not true since I'm already booted with this kernel - "To ensure you system remains bootabel, GTUB will not be upgraded on your disk unril these kernels are removed or replaced with signed kernels"

I guess it's due to new MOK key genereated , while grub /shim config doesn't now location of my key. Am i right? Can i safely reboot? Can I safely enter password enrolling new MOK key - will it be enrolled next to my old one or replace it ?