On September 11, 2025, the Microsoft key that signs every Linux distribution's Secure Boot shim bootloader expires, and many motherboards lack the replacement key from 2023.
The September Deadline
Mateus Rodrigues Costa spotted the warning in this month's Windows 11 cumulative update, but the Linux world has its own certificate ticking clock. The 2011 Microsoft UEFI key used to sign the first-stage shim bootloader expires in under three months. Without it, new Linux installation media will not boot on Secure Boot-enabled systems unless the firmware has the 2023 Microsoft key installed.
Daniel P. Berrangé pointed to the LVFS site that documents the mess. LVFS, the home of fwupd, is the pipeline for vendor firmware updates from Linux. The problem: some systems have both old and new keys, some only the old, and a few already only the new. If your machine shipped after 2023 with only the new key, you already can't boot current Linux install media with Secure Boot enabled.
Why Firmware Updates Fail
LVFS creator Richard Hughes reports that KEK (key exchange key) updates succeed about 98% of the time, and direct db updates succeed about 99% of the time. But 1% of millions is a lot of people. The common failure is an "efivarfs write" error caused by fragmentation of the EFI variable storage space. Rebooting and resetting BIOS to factory defaults often triggers a defrag and lets the update through. Older BIOS versions are more likely to hit this.
Worse: at least one manufacturer has lost access to the private half of its platform key (PK). That means the hardware's burned-in key needs replacement - uncharted territory and a nightmare for attestation. Gerd Hoffman noted the KEK update process itself is new and untested at scale.
What You Can Do Now
For installed systems: if Secure Boot already works, it should keep working because the bootloader is signed with a distribution-specific key chain rooted in the firmware. The problem strikes only new installations. If you buy a new laptop or motherboard today, check whether its firmware includes the 2023 Microsoft key. If not, you will need a vendor firmware update or disable Secure Boot for any new Linux install.
Run fwupdmgr get-updates to see if your vendor has pushed a KEK or db update. If fwupd reports no updates, your hardware vendor may never ship one. In that case, either disable Secure Boot or maintain a bootable USB with an older shim - but even that won't work after September 11 if the system only has the new key.
Linux distributors are scrambling to produce installation media signed with the 2023 key. Expect new ISOs in the next few weeks. But if your firmware doesn't have that key, those ISOs won't help. The only reliable fix for that class of machines is a firmware update from the vendor - or flipping Secure Boot off.
Source: Linux and Secure Boot certificate expiration
Domain: lwn.net
Comments load interactively on the live page.