{"id":182058,"date":"2026-06-14T14:48:26","date_gmt":"2026-06-14T12:48:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux"},"modified":"2026-06-14T14:48:26","modified_gmt":"2026-06-14T12:48:27","slug":"istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","title":{"rendered":"Istje\u010de vrijeme trajanja certifikata koji potpisuje bootloader za UEFI Secure Boot u distribucijama Linuxa","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Razvija\u010di Fedora Linux razjasnili su situaciju vezanu uz isteka certifikata Microsofta krajem lipnja, koji se koristi za potpisivanje Shim sloja, koji se koristi za provjeru digitalnog potpisa Linux distribucija u UEFI Secure Boot re\u017eimu. Prijelaz na novi certifikat trebao bi pro\u0107i neprimjetno za korisnike jer zapravo zavr\u0161etak vijeka trajanja certifikata dovodi samo do nemogu\u0107nosti njegove upotrebe za stvaranje novih potpisa. Tijekom pokretanja UEFI Secure Boot, vijek trajanja certifikata se ne provjerava i va\u017ean je samo opoziv kompromitiranih certifikata. <\/p>\n

Postoje\u0107i sustavi bez instalacije a\u017euriranja shim nastavit \u0107e se pokretati sve dok javni klju\u010d certifikata ne bude uklonjen iz firmware-a ili ne bude stavljen na popis opozvanih certifikata UEFI (DBX). Microsoftov klju\u010d potpisuje samo Shim sloj za pokretanje, u kojem je prisutan javni klju\u010d distribucije, koji se koristi za potpisivanje komponenti koje se u\u010ditavaju, kao \u0161to su GRUB2 bootloader, Linux jezgra, moduli jezgre i procesi kori\u0161teni pri pokretanju, kao \u0161to je fwupd. Ovakav pristup omogu\u0107ava Microsoftu da potpisuje samo promjene u Shim sloju i samostalno osigura provjeru procesa pokretanja distribucije.<\/p>\n

Microsoftov certifikat za potpisivanje tre\u0107ih strana firmware-a za UEFI Secure Boot vrijedi od 2011. godine. U 2023. godini generiran je novi certifikat koji \u0107e se koristiti za formiranje potpisa od listopada 2025. godine. U repozitorij Fedora Rawhide, na temelju kojeg se formira Fedora 45, ve\u0107 je dodan a\u017eurirani shim, potpisan s nekoliko klju\u010deva kako bi se osigurala maksimalna kompatibilnost s hardverom (mo\u017ee se koristiti kako na starim firmware-ima bez javnog klju\u010da novog certifikata, tako i na firmware-ima bez javnog klju\u010da starog certifikata).<\/p>\n

Iako isteak Microsoft certifikata ne bi trebao utjecati na funkcionalnost podizanja sustava, Fedora programeri preporu\u010duju korisnicima da a\u017euriraju bazu podataka s klju\u010devima za Secure Boot prilikom pojave novih verzija firmware-a za njihovu opremu. Za provjeru je li sustav podignut u UEFI Secure Boot modu, mo\u017ee se upotrijebiti naredba «mokutil —sb-state», a za prikaz popisa dostupnih otvorenih klju\u010deva u firmware-u — «mokutil —db —short». Za pregled klju\u010deva kojima je potpisan shim sloj, mo\u017ee se pokrenuti naredba «sudo pesign -S -i \/boot\/efi\/EFI\/fedora\/shimx64.efi», prethodno instalirav\u0161i paket pesign. Za provjeru dostupnosti a\u017euriranja firmware-a i njegove instalacije mo\u017ee se izvr\u0161iti naredba «sudo fwupdmgr update». <\/p>\n

Sljede\u0107a verzija shim sloja bit \u0107e ovjerena samo novim Microsoftovim certifikatom, a nadogradnja firmvera je nu\u017ena za pripremu va\u0161ih sustava za ovu promjenu. Nadogradnja shim-a bit \u0107e izdana u slu\u010daju otkrivanja ranjivosti i ozbiljnih gre\u0161aka, \u0161to se mo\u017ee dogoditi za mjesec dana ili za godinu. Tijekom postojanja shim projekta otkrivene su kriti\u010dne ranjivosti, a posljednji izvje\u0161taj o sigurnosnim problemima u shim-u objavljen je tek prije nekoliko dana. <\/p>\n

Izvje\u0161taj isti\u010de dvije nedavno otkrivene ranjivosti CVE-2026-8863 i
\nCVE-2026-10797, koje omogu\u0107uju izvr\u0161avanje vlastitog koda u rano pokretanje prije nego \u0161to se kontrola predaje operativnom sustavu, zaobila\u017eenje za\u0161tite UEFI Secure Boot i omogu\u0107avanje pokretanja neovjerenih digitalno potpisanih komponenti jezgre. Problemi se odnose na verzije shim-a do verzije 0.9 uklju\u010divo, formirane do 2016. godine. Stare sustave kao \u0161to su
\n RedHat Enterprise Linux 7.2, CentOS 7.2, Oracle Linux 7.2, ROSA Linux R10\/R9 i openSUSE sa shim-om 0.9 su podlo\u017eni napadu. Shim slojevi do verzije 0.9 uklju\u010divo dodani su u bazu opozvanih digitalnih potpisa DBX (UEFI Forbidden Signature Database) i u slu\u010daju a\u017euriranja DBX-a u sustavu ne\u0107e mo\u0107i koristiti za pokretanje u re\u017eimu UEFI Secure Boot.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Fedora Linux \u043f\u0440\u043e\u044f\u0441\u043d\u0438\u043b\u0438 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0438\u044e\u043d\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Microsoft, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 Shim, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 UEFI Secure Boot. \u041f\u0435\u0440\u0435\u0445\u043e\u0434 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0440\u043e\u0439\u0442\u0438 \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0442\u0430\u043a \u043a\u0430\u043a \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0436\u0438\u0437\u043d\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043f\u0440\u0438\u0432\u0435\u0434\u0451\u0442 \u043b\u0438\u0448\u044c \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182058","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Iste\u0107i \u017eivotni vijek certifikata koji ovjerava u\u010ditava\u010d za UEFI Secure Boot u Linux distribucijama | ProHoster","description":"Programeri Fedora Linux pojasnili su situaciju vezanu za isteka u lipnju Microsoftovog certifikata, koji se koristi za ovjeru digitalnim potpisom shim sloja, koji se koristi za provjeru.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u0442\u0435\u043a\u0430\u0435\u0442 \u0432\u0440\u0435\u043c\u044f \u0436\u0438\u0437\u043d\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u0430\u0432\u0435\u0440\u0435\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0434\u043b\u044f UEFI Secure Boot \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Fedora Linux \u043f\u0440\u043e\u044f\u0441\u043d\u0438\u043b\u0438 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0438\u044e\u043d\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Microsoft, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 Shim, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-14T12:48:27+00:00","article:modified_time":"2026-06-14T12:48:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182058","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:23","updated":"2026-08-05 12:22:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/182058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=182058"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/182058\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=182058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=182058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=182058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}