Linux and Secure Boot certificate expiration (2025)
1–10 of 70 posts
Re: Linux and Secure Boot certificate expiration (2025)
#2They left out the steps to update it. I made a rough attempt at a document for this. [1] Please let me know if I missed a validation step. I have done this on six machines but they were all Linux. Not tested on BSD.
Archive [2] in the event I was too aggressive in blocking bots.
[Edit] I should also include this [3] thread for completeness sake. Some people people were playing with a shim work around but it looks like a lot of unnecessary complexity and fragility to me.
[1] - https://nochan.net/b/Internet-Crap/20260621-Update-Secure-Bo...
[2] - https://archive.is/ml3jv
[3] - https://www.reddit.com/r/archlinux/comments/1pvw6td/grub_shi...
Re: Linux and Secure Boot certificate expiration (2025)
#3> The KEK updates are going out at ~98% success, and db update is ~99% success
glad to see the opt in fwupd analytics being so useful for something like this
Not envious of the running around contacting vendors they must of been doing on such short order.
Re: Linux and Secure Boot certificate expiration (2025)
#4I saw 2-3 flavors of this news. None of them include a basic “how do I check if I need to do anything” guide that a linux newbie can do.
Re: Linux and Secure Boot certificate expiration (2025)
#5[flagged]
Re: Linux and Secure Boot certificate expiration (2025)
#6I saw 2-3 flavors of this news. None of them include a basic “how do I check if I need to do anything” guide that a linux newbie can do.
On my Fedora machine I was able to run
mokutil --db --short
Re: Linux and Secure Boot certificate expiration (2025)
#7[flagged]
It's not exactly new for Microsoft to slide themselves in somewhere and become the "standard" before anyone has really thought about how terrible their products are.
Re: Linux and Secure Boot certificate expiration (2025)
#8[flagged]
You can load your own Secure Boot keys and sign your bootloader yourself; as for why the Microsoft ones are preloaded, probably because they're the only entity that interacts with all of these OEMs and had enough leverage over them to force Secure Boot adoption in the first place.
Re: Linux and Secure Boot certificate expiration (2025)
#9[flagged]
It's for your own security, duh ;)
Re: Linux and Secure Boot certificate expiration (2025)
#10I'm surprised more people aren't freaking out about this. It seems likely a whole lot of Linux machines are going to fail to reboot in the next few months. The problem affects VMs too. I was grateful Proxmox put a little warning in its hypervisor GUI with a button to press to fix the BIOS of its VMs.
Secure Boot has been deeply broken for years, not providing meaningful security on most consumer machines.