How to update the Microsoft Secure Boot certificate for Linux

This guide explains how to manage the transition of Microsoft's Secure Boot signing certificate, a crucial process for the correct booting of Linux systems on hardware with Secure Boot enabled.

Secure Boot is a firmware feature that ensures only trusted software is launched during computer startup. For Linux systems, this process requires the use of a Microsoft-signed bootloader called shim, as most firmware does not directly recognize Linux systems.

Microsoft's 2011 UEFI certificate, widely used in the Secure Boot chain, is set to expire in June. Linux distributions must therefore switch to the new 2023 certificate to avoid booting issues.

This transition is fundamental for Linux users, especially those using hardware with Secure Boot enabled, to ensure that systems continue to function correctly after the old certificate expires.

By following this guide, technical users will be able to update their systems to use the new certificate, ensuring that their computers continue to boot correctly with Secure Boot enabled.

Prerequisites

• Hardware: A PC with Secure Boot enabled
• Software:
  • Installed Linux operating system
  • Updated shim packages
  • Updated firmware
  • Updated Secure Boot database

PROCEDURE: Updating the Microsoft Certificate for Secure Boot

By the end of this guide, you will have correctly updated the Microsoft certificate for Secure Boot on your Linux system, ensuring boot continuity on Secure Boot-enabled machines.

• Check the current version of the shim package installed on your system. Open a terminal and type the command: dpkg -l | grep shim or rpm -qa | grep shim depending on your operating system.
• Update the shim package to the latest available version. On Debian/Ubuntu systems, use: sudo apt update && sudo apt upgrade shim On Red Hat/CentOS systems, use: sudo yum update shim
• Update your system's firmware. Refer to the manufacturer's manual for your hardware for specific instructions on how to update the firmware.
• Verify that the new Microsoft 2023 certificate has been correctly added to the Secure Boot database. Open a terminal and type the command: sudo mokutil --list-enrolled Make sure the new certificate is present in the list.

Verification and Troubleshooting

By the end of this guide, you will be able to test the correct operation of the Secure Boot boot process and resolve any issues related to the expiration of the Microsoft certificate.

Functionality Test

• Verify system boot: Turn on the computer and make sure the Linux operating system boots correctly with Secure Boot enabled.
• Check the boot log: Use the command journalctl -b to view the boot log and verify that there are no errors related to Secure Boot or the shim bootloader.
• Verify the bootloader signature: Run the command sbverify --list /boot/efi/EFI/your_distro/shim.efi to check that the shim bootloader is correctly signed.

Troubleshooting

• Update the system and shim packages: Run the update commands for your operating system to ensure you have the latest version of shim and other related packages.
• Update the Secure Boot database: Follow the instructions provided by your Linux distribution to update the Secure Boot database and include the new Microsoft 2023 certificate.
• Avoid manual changes: Do not manually modify the Secure Boot keys unless explicitly requested by the vendor or distribution.

If the system does not boot correctly, consult the documentation of your Linux distribution or contact technical support for further assistance.

Educational Summary and Call to Action

By the end of this guide, you will have understood the importance of the transition of Microsoft's Secure Boot signing certificate and how this impacts the Linux world. Now you are ready to act proactively to ensure that your systems continue to function without interruptions.

• Keep systems updated: Make sure your operating system, shim packages, firmware, and Secure Boot database are always up to date.
• Pay attention during the transition: Be particularly attentive during the transition period, especially if you are installing new Linux images, updating shim packages, or working with older hardware.

By following these steps, you will be able to navigate this critical transition smoothly and keep your Linux systems secure and functional.