You need to change the interface mask to /32 on the hub and spoke tunnel interfaces and it fixed the issue.

it is expected behavior as Secure boot is enabled . reference: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn47021 Please choose answer correct)