As I’ve just seen yet another article about that, I was wondering if the current BIOS versions already do include the new keys from Microsoft as the current keys are about to become invalid. Sadly, the knowledge base doesn’t list anything, as searching for topics about this doesn’t reveal anything. …

This just popped up on my Fedora 42 system, is it the same thing? $ fwupdmgr get-updates Devices with no available firmware updates: • HDMI Expansion Card • KEK CA • SBAT • SSD 990 PRO 2TB • TPS DMC Family • TPS6598X PD#0 • TPS6598X PD#1 • USB3.0 Hub • Windows Production PCA • frame.wor…

That could be possible, but I can’t say for sure. Something like that would have to be verified by Framework (as I don’t think this will be shipped by MS directly, as for all I know a vendor specific key would be needed to update these without a BIOS update. But the description sounds like this is r…

The UEFI 2023 certificates were already present out of the box for my Framework 13 (AI 300), so it looks like Framework’s been including them in their recent firmware (BIOS) versions.

How can you tell though? I think that’s the main point of my post, people should know that they need this update and they need it soon, and how to tell if it’s present or not.

If you boot into UEFI settings and go to the “Administer Secure Boot” page (might be named differently on different models), you can check the current KEK and DB lists for entries that looking like “Microsoft ______ CA 2023” or “Windows ________ CA 2023”. If those are present you’re good, if only th…

Under Administer Secure Boot > KEK Options I see “Microsoft Corporation KEK CA 2011” and “frame.work-LaptopAMDKEK”. DB options also only shows 2011. And no, this does not affect only Linux. Because the entire keychain is being replaced, this does affect the entirety of Secure Boot - except when you…

In contrary to @next_to_utter_chaos (here: Secure Boot and Expiring Microsoft Keys - #4 by next_to_utter_chaos ) I am not offered the new keys. And they are not yet there as this commands does not return anything: sudo efi-readvar -v db | grep "UEFI CA 2023" I just can confirm existence of the o…

That’s odd. I got that update like 3 days ago on my FW16 through fwupdmgr. sudo efi-readvar -v db | grep “UEFI CA” C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011 C=US, O=Microsoft Corporation, CN=Microsoft UEFI CA 2023 C=US, O=Microsoft Corporation…

Thanks for your reply. It indeed is a different platform. 12th gen Intel from Q1 2023. Hope they don’t forget to update the older devices.

Microsoft KEK update availability?

Community Support

Thilo_Schulzke August 18, 2025, 7:07pm 8

probably a dupe of Secure Boot and Expiring Microsoft Keys - #4 by next_to_utter_chaos

Topic		Replies	Views
Secure Boot and Expiring Microsoft Keys Linux fedora	3	1003	July 23, 2025
Windows Secure Boot certificates begin expiring in June 2026 Framework Laptop 13 windows , bios , intel-12th	15	3214	June 19, 2026
Windows 11 Secure Boot Certificate Update Community Support amd-7040 , other-issues	8	281	June 19, 2026
13th Gen Intel Bios update for new secure boot keys Framework Laptop 13 windows , bios , intel-13th	3	187	February 13, 2026
Need to reset SecureBoot seetings to factory default after BIOS update? Linux linux-mint	2	334	April 8, 2026

Microsoft KEK update availability?

Related topics