Linux PCs Need 2023 Secure Boot Keys Before 2011 Certificates Expire in 2026
Updated
Updated · ZDNet · Jun 24
Linux PCs Need 2023 Secure Boot Keys Before 2011 Certificates Expire in 2026
3 articles · Updated · ZDNet · Jun 24
Summary
2026 certificate expiry mainly threatens future Linux installs and updates, not machines already booting with Secure Boot enabled.
Microsoft’s 2011 Secure Boot certificates begin expiring in two 2026 waves, while newer 2023 keys are being pushed through OEM firmware updates to preserve trust for new boot components.
Firmware updates are the critical fix: users should install recent BIOS/UEFI releases—often via fwupdmgr on Linux—and then test a current distro ISO with Secure Boot turned on.
Major distributions including Fedora, RHEL, Ubuntu, SUSE and Debian have largely prepared their shim and signing chains, but older PCs without updated firmware could fail to boot newer images.
Disabling Secure Boot remains a fallback, but the report warns against making it permanent because it removes a meaningful defense against bootkits, rootkits and other persistent malware.