virtualbox - Can't sign vboxdrv, mokutil thinks Secure Boot is not supported yet it is

I'm having issues running virtualbox, it requires the driver to be signed or the installation fails and it doesn't start the vms.

I've read this is because the host service has secure boot enabled, which I do because of work requirements (I can't disable it), however perhaps is not properly configured?

So the following three things lead me to believe is enabled:

[ -d /sys/firmware/efi ] && echo "Installed in UEFI mode" || echo "Installed in Legacy mode"
Installed in UEFI mode

In the BIOS I can also see Secure Boot as enabled.

And virtualbox fails presumably because it requires the driver to be signed, I gather from other questions that this is the way it has to be because that's what Secure Boot is supposed to check, and since I'm compiling the driver locally with dkms there's no other way but to sign it myself.

However when I try to sign the driver manually, mokutil gives me this error:

# mokutil --sb-state
This system does't support Secure Boot

I don't understand what is it checking to believe is not enabled or if it's really not enabled.
I'm using Ubuntu 16.10

The error virtualbox gives is:

Failed to open a session for the virtual machine Hortonworks Docker Sandbox.

The virtual machine 'Hortonworks Docker Sandbox' has terminated unexpectedly during startup with exit code 1 (0x1).

Result Code: NS_ERROR_FAILURE (0x80004005) Component: MachineWrap
Interface: IMachine {b2547866-a0a1-4391-8b86-6952d82efaa0}

Kernel driver not installed (rc=-1908)

The VirtualBox Linux kernel driver (vboxdrv) is either not loaded or
there is a permission problem with /dev/vboxdrv. Please reinstall the
kernel module by executing

'/sbin/vboxconfig'

as root.

where: suplibOsInit what: 3 VERR_VM_DRIVER_NOT_INSTALLED (-1908) - The
support driver is not installed. On linux, open returned ENOENT.

I tried purging all the installers, and re-installing which seems to have worked for some people, I tried looking if there were some pre-signed drivers available so maybe I can downgrade the kernel I'm using.

I don't think that's the problem.

In /var/log/vbox-install.log you can repeatedly find

make KBUILD_VERBOSE=1 SUBDIRS=/tmp/vbox.0 SRCROOT=/tmp/vbox.0
CONFIG_MODULE_SIG= -C /lib/modules/4.8.0-39-generic/build -j4 modules
make[1]: warning: -jN forced in submake: disabling jobserver mode.
test -e include/generated/autoconf.h -a -e include/config/auto.conf ||
( \ echo >&2;
\ echo >&2 " ERROR: Kernel configuration is invalid."; \

echo >&2 " include/generated/autoconf.h or
include/config/auto.conf are missing.";\ echo >&2 " Run 'make
oldconfig && make prepare' on kernel src to fix it."; \ echo >&2
;

I'm most intrigued by the state of Secure Boot because as far as I was able to gather, the statements at the beginning of the question should tell me I'm using it, and I want to make sure it's working correctly. Though I could potentially not even be generating the driver to sign to begin with and then it doesn't have anything to do with secure boot, which is unlikely since disabling secure boot seems to be what everyone's doing to get around this.

Encountered similar problem, and switching Secure Boot Mode from Standard to Custom in BIOS (UEFI) setup fixed it. In my BIOS it is a separate option from Secure Boot Support, which remained Enabled. YBIOSMV.