Folks, I’m looking for help / clarification on the news going around about expiring Microsoft keys for secure boot. While I am an experienced computer user, I’ll admit firmware is at the very edge of my knowledge.
i’ve seen a few posts, such as this one, that the keys used for secure boot from 2011 are going to expire and at minimum need to be updated to the 2023 ones (I think), OR, as I’ve seen in a few posts here, there is a way to roll your own as well (which are fine? maybe?)
To be honest, I’m not sure if any of this even applies to my Framework computer.
So I’d like to know:
How do I know if this is a concern for my computer?
How do i check which keys I am using?
If needed, how do I update them?
I am on Fedora, Framework 13, 12th gen i5. But that said, I would imagine i’m not the only one who will have this question, so if there are general guidance, i think that would be appreciated.
This will need to be something that Fedora provides to you. They are the one using the key as part of their shim.
You can access secure boot via the bios options. (F2 at boot) There you can look at the installed keys, etc.
Fedora, the one reliant on this security key to build their shim, would be the one that needs to address that.
However, one big obvious here is that you can avoid all of this by just disabling secure boot. So even if the key expires and you couldn’t boot with secure boot on, you can always boot with it off.
Framework has already added them to their recent BIOS versions (they were included out of the box on my FW 13 AI 300 model), you can verify they’re present by booting into UEFI settings → “Administer Secure Boot” and then checking the KEK and DB sections for the Microsoft KEK/UEFI CA 2023 and Windows UEFI CA 2023 entries. Even if they’re not included in your BIOS you’ll eventually get a separate update through fwupd that loads them.
And I just got the update (2011 → 2023) offered by fwupdmgr refresh & fwupdmgr get-updates for the 3rd party Microsoft Key:
Description:
This updates the 3rd Party UEFI Signature Database (the "db") to the latest release from Microsoft. It also adds the latest OptionROM UEFI Signature Database update.
And efi-readvar -v db | grep "UEFI CA" seems to hint that the keys got updated successfully:
C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011
C=US, O=Microsoft Corporation, CN=Microsoft UEFI CA 2023
C=US, O=Microsoft Corporation, CN=Microsoft Option ROM UEFI CA 2023