{"id":182058,"date":"2026-06-14T14:48:26","date_gmt":"2026-06-14T12:48:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux"},"modified":"2026-06-14T14:48:26","modified_gmt":"2026-06-14T12:48:27","slug":"istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","title":{"rendered":"The lifespan of the certificate that certifies the bootloader for UEFI Secure Boot in Linux distributions is expiring.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Fedora Linux developers clarified the situation regarding the expiration of the Microsoft certificate used for signing the Shim layer, which is used for verified boot of Linux distributions in UEFI Secure Boot mode, set to expire at the end of June. The transition to the new certificate is expected to be seamless for users, as the actual expiration will only prevent its use for generating new signatures. During the UEFI Secure Boot process, the validity of the certificate is not checked and is only relevant in terms of revocation of compromised certificates. <\/p>\n
Existing systems without the shim update will continue to boot until the public key of the certificate is removed from the firmware or placed on the UEFI revoked certificates list (DBX). Only the boot shim layer is certified by Microsoft, which includes the public key of the distribution used to certify boot components such as the GRUB2 bootloader, Linux kernel, kernel modules, and boot processes like fwupd. This approach allows Microsoft to certify only changes to the shim layer while independently ensuring the verification of the distribution's boot process.<\/p>\n
The Microsoft certificate for signing third-party firmware for UEFI Secure Boot has been in effect since 2011. In 2023, a new certificate was generated to replace it, which will be used for signing starting October 2025. The updated shim, signed with multiple keys for maximum hardware compatibility, has already been added to the Fedora Rawhide repository, which forms the basis of the Fedora 45 release (it can be used on both old firmware without the public key of the new certificate and on firmware without the public key of the old certificate).<\/p>\n
Although the expiration of a Microsoft certificate should not affect the functionality of the boot process, Fedora developers recommend that users update the database with keys for Secure Boot when new firmware versions for their hardware are released. To determine if the system is booting in UEFI Secure Boot mode, you can use the command 'mokutil --sb-state', and to display the list of open keys available in the firmware, use 'mokutil --db --short'. To view the keys used to sign the shim layer, you can run the command 'sudo pesign -S -i \/boot\/efi\/EFI\/fedora\/shimx64.efi', after installing the pesign package. To check for firmware updates and install them, use the command 'sudo fwupdmgr update'. <\/p>\n
The next version of the shim layer will be signed only with the new Microsoft certificate, and a firmware update is necessary to prepare your systems for this change. The shim update will be released if vulnerabilities or serious bugs are identified, which could happen in a month or a year. During the existence of shim in the project, critical vulnerabilities have been found, and the last report on security issues in shim was released just a few days ago. <\/p>\n
The report noted two recently discovered vulnerabilities CVE-2026-8863 and \nCVE-2026-10797, which allow achieving code execution at an early stage of the boot process before control is transferred to the operating system, bypassing UEFI Secure Boot protection, and enabling the loading of unsigned kernel components. These problems affect shim versions up to and including release 0.9, created before 2016. Very old systems such as \n RedHat Enterprise Linux 7.2, CentOS 7.2, Oracle Linux 7.2, ROSA Linux R10\/R9, and openSUSE with shim 0.9 are vulnerable to attack. Shim layers up to and including version 0.9 have been added to the revoked signature database DBX (UEFI Forbidden Signature Database), and if the DBX is updated, they will be unable to boot in UEFI Secure Boot mode. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"