Linux and Secure Boot certificate expiration
Linux users with Secure Boot enabled face potential boot issues due to the upcoming expiration of a Microsoft-signed UEFI bootloader key. While a replacement key exists, it may require firmware updates from hardware vendors that are not guaranteed to be released.
Why it matters
This technical hurdle could prevent some Linux systems from booting if the necessary firmware updates are not applied before the key expires.
Linux users who have Secure Boot enabled on their systems knowingly or unknowingly rely on a key from Microsoft that is set to expire in September. After that point, Microsoft will no longer use that key to sign the shim first-stage UEFI bootloader that is used by Linux distributions to boot the kernel with Secure Boot. But the replacement key, which has been available since 2023, may not be installed on many systems; worse yet, it may require the hardware vendor to issue an update for the system firmware, which may or may not happen. It seems that the vast majority of systems will not be lost in the shuffle, but it may require extra work from distributors and users.
The article provides a technical overview of a software maintenance issue without political or social bias.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in