Linux users face a Microsoft Secure Boot headache – here’s the painkiller


gettyimages-1191423643

SEAN GLADWELL/ Moment via Getty

Follow ZDNET: Add us as a preferred source on Google.


ZDNET’s key takeaways

  • Linux has a new Secure Boot problem.
  • But it’s not nearly as bad as some people make out.
  • Here’s what you can do to address the issue.

Back in the late 2000s, computer firmware was moving from legacy BIOS to UEFI Unified Extensible Firmware Interface (UEFI). Alongside it came Secure Boot. This Microsoft-supported security mechanism was designed to stop bootkits and firmware‑level malware that traditional operating system security couldn’t detect in its tracks. Secure Boot was messy, but it did the job. For people trying to install and run Linux on Windows PCs, this setup was a real pain in the rump. Here we are, 14 years after Secure Boot first appeared on Windows 8 PCs, and it once again has the potential to give Linux users a real headache.

Once again, some Linux lovers are in a panic that “Microsoft is locking Linux out!” That’s not what’s going on. As Microsoft pointed out, “Secure Boot certificates have always had expiration dates.” Yes, yes, they have. Besides, as Ed Bott recently observed, while it’s not nearly as annoying for Windows users, some people may still have trouble with expiring Secure Boot certificates

The good news is that this concern is not a doomsday event for Linux. Your existing systems aren’t going to wake up one morning and refuse to boot just because a date rolled over. But it is a moment of truth about how the Linux world has handled Secure Boot for more than a decade, and an opportunity for users to take more control, rather than quietly hoping that Microsoft and OEMs keep the lights on forever.

Also: I tested the best MacOS alternative on Linux again – and it even mimics Liquid Glass now

Let’s walk through what’s actually happening, why Linux is involved, and what you should be doing before 2026 and beyond.

An old compromise comes due

To understand why, you have to go back to 2011 to 2012, when UEFI Secure Boot first landed on mass‑market PCs. The design goal sounded reasonable: stop untrusted code from running before the operating system by having firmware verify signatures of bootloaders, kernels, and option ROMs.

In practice, though, Microsoft effectively defined the trust roots for almost every consumer PC. Rather than creating — or having users create — Secure Boot keys and certificates, most hardware vendors shipped machines with a set of keys and certificates embedded in the firmware. Most of these keys and certificates were “Microsoft 3rd‑party UEFI CA” that could sign third‑party bootloaders. Distributions that wanted to “just boot” on these systems without asking users to flip obscure firmware switches basically had two options:

  • Ship instructions for users to disable Secure Boot.
  • Or play along and get a tiny first‑stage bootloader (shim) signed by Microsoft’s UEFI CA.

Most major Linux distributions chose shim. Matthew Garrett, a well-known Linux programmer, created the shim approach, and it’s still used today. 

This approach was a pragmatic compromise: Microsoft verifies the shim, the shim verifies the rest of the Linux boot chain, and users don’t have to hand‑edit UEFI key databases or turn off security features.

Also: Windows Subsystem for Linux gives developers a compelling reason to stick with Microsoft – here’s why

That compromise worked remarkably well. For more than a decade, you could buy a random laptop, flip Secure Boot on, and boot Fedora, Ubuntu, openSUSE, Debian, RHEL, and others, all thanks to the Microsoft key stored in your firmware and a Microsoft‑signed shim binary in your EFI System Partition.

But certificates, unlike compromises, have expiration dates.

What’s expiring in 2026?

The root of today’s drama is that the 2011 certificates Microsoft has been using to sign Secure Boot components are nearing the end of their formal validity period. Several of the 2011‑era Microsoft Secure Boot certificates reach their end of life in 2026, in two main waves (mid‑year and later in the year).

To address this issue, Microsoft created a new set of Secure Boot certificates in 2023 and began distributing them to OEMs and platforms. Firmware updates are supposed to do the quiet work: adding new keys, keeping the old ones for compatibility, and ensuring future boot components can be validated.

Also: Microsoft continues its big Linux push at Build 2026

For Windows‑only shops, this is mostly an automatic patch job. For the Linux world, it’s a different story, 

When people hear “certificate expiration,” they tend to imagine something like an SSL certificate: once it’s past the “notAfter” date, clients refuse to talk to the server. That mental model makes 2026 sound like a cliff edge: June 24 arrives, and suddenly your distro won’t boot.

Secure Boot doesn’t work that way. If your firmware already trusts the 2011 Microsoft UEFI CA today, it will almost certainly continue to trust it after the calendar rolls into the expiration window. Existing Linux installs, with their existing shim and bootloaders, will continue to boot as they always have. Nothing will magically brick itself at midnight.

Here’s the problem

The trouble is not your present boot; it’s your future boot. If your older PC’s firmware never gets the 2023 keys, and the rest of the world starts assuming those keys exist, you can end up stuck in a weird limbo. While your existing Linux install will still boot, a new or updated distro won’t. 

Also: Microsoft surprises with its first server Linux distribution: Azure Linux 4.0

Hopefully, your PC vendor will ship firmware with the new keys, the Linux distros update their shims to be compatible with the new keys, and everything works out. We should be so lucky. 

Here’s what to do:

1. Update your firmware

Every major vendor has been shipping updates that, among other things, add or adjust Secure Boot keys in response to Microsoft’s 2023 certificates and the upcoming expirations. You don’t need to know the exact key IDs to benefit; you need to make sure your system receives those updates.

On a typical Linux machine, that approach means checking your vendor’s support site for BIOS/UEFI updates released in the last year or two. On many systems, you can use Linux’s firmware update stack, fwupd, to handle this from within your distro. To take this step, run the following commands as the root user:

  • fwupdmgr refresh
  • fwupdmgr get-updates
  • fwupdmgr update

If your hardware is supported, these steps will pull down firmware capsules and UEFI db/dbx updates that include the new Microsoft Secure Boot certificates. After the update, you’ll need to reboot once or twice; the firmware will update itself, and you’re done.

Also: My top 5 Linux desktops of 2026 (so far) – and I’ve tried them all

On some older systems, you may still have to download an .exe or .iso from the vendor and follow their dance. This procedure is annoying, but it’s a one‑time chore that buys you years of smoother Secure Boot behavior.

2. Check how your distro handles certificates

Most mainstream Linux distributions have already considered the 2026 expiration and concluded that it is not an emergency but something to address carefully.

Many distributions are aligning their shim builds and signing processes to remain compatible throughout the transition. If you’re on a modern release of a big‑name distro and your firmware is up‑to‑date, chances are high that “it just works” will continue to be true.

For you, the simplest test is also the most practical:

Do this test once now, so you know what the new normal looks like. If a future image fails to boot with Secure Boot enabled, you’ll be able to tell whether the regression is in the firmware (keys not updated), the distro’s image, or a nasty interaction between the two.

Also: After 30 years with Linux, I gave Windows 11 a chance – and found 9 clear problems

Many of the most popular Linux distros have already addressed the Secure Boot issue. Red Hat has published dedicated guidance on Secure Boot expiration and maintains RHEL/Fedora shim/bootloader stacks that are signed and aligned with Microsoft’s trust model. Canonical’s Ubuntu family has long shipped full Secure Boot support. Ubuntu’s current installers and kernels are signed under the existing Microsoft 3rd‑party UEFI CA.

SUSE and openSUSE are also ready to go with the new CAs. Debian’s Secure Boot infrastructure is important because its shim is used by many distros and was developed by a cross‑distro team. Some Linux distros, however, such as Arch and its relatives, do not make it easy to support Secure Boot

The tempting workaround

If you hang around Linux forums long enough, you’ll see the same advice repeated whenever Secure Boot comes up: “If it gives you trouble, just disable Secure Boot.”

I get it. I’ve done it myself. Secure Boot has been a pain since it first appeared. For many users, the easiest path has been to turn it off and make the problem disappear.

The danger is when the temporary hack becomes permanent. With Secure Boot disabled, you lose the Secure Boot defense against rootkits and the like. While “script‑kiddie” rootkits are less common than they were a decade ago, modern user‑, kernel‑, and even hypervisor‑level rootkits are still very much in active use by both crooks and high‑end attackers. Rootkits remain one of the nastier classes of malware because they focus on stealth and persistence.

Also: What is immutable Linux? Here’s why you’d run an immutable Linux distro

Is Secure Boot a silver bullet? No. Does it replace good system hygiene, patching, and backups? Absolutely not. But Secure Boot is a meaningful shield, and the Linux ecosystem has worked hard to make it mostly invisible to everyday users. Throwing Secure Boot away because it’s a pain today is a mistake. 

Here, specifically, is what you should do about the expiring certificates.

For your PCs:

  • Update firmware: Before mid‑2026, install the latest BIOS/UEFI updates from your vendor. If fwupd supports your hardware, use it. It’s less painful than juggling Windows tools or bootable updaters.
  • Confirm Secure Boot still works: Make sure your existing distro boots cleanly with Secure Boot enabled. Then try a current live image from the same distro. If both work, you’re in good shape.
  • Keep Secure Boot on, if you can: Treat it as a normal part of your system’s security posture. If something fails, debug and temporarily disable it as needed, but don’t abandon it lightly.

For your servers:

  • Inventory what you have: Note which machines have Secure Boot enabled and what firmware they’re running. You don’t need a fancy Configuration Management Database (CMDB); a spreadsheet is fine.
  • Standardize on a firmware baseline: Pick current firmware versions that include the new Secure Boot keys (your vendor’s release notes may mention this) and roll them out across your lab.
  • Test new images early: Before you upgrade everything to a new major distro release, test that release’s installer and boot chain on a representative system with Secure Boot on, catch surprises on a sacrificial node.

So, in short, while this Secure Boot is a headache, it’s not that bad. Just make sure your firmware is up to date, and your Linux distro is ready to handle the new certificates, and all will be well. 





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


The Paradox of Preppers Who Want Stock Tips

I’ve had some rather paradoxical conversations in recent weeks. One second, I’m standing there talking to people about prepping—buying water, hand-crank radios, and whatnot. Then two minutes later, they’re asking me, “Lars, which shares should I buy?” There’s something deeply contradictory about that, isn’t there?

This captures the strange moment we find ourselves in. Drones are flying over Copenhagen, jet fighters are scrambling over Danish airspace, and yet many Danish investors have made substantial money on their shares in recent years. The disconnect between our anxieties and our investment behaviours has never been more pronounced.

We’re facing what I’d characterise as three dark clouds hanging over the investment landscape. These aren’t merely theoretical concerns—they’re real, measurable risks that could fundamentally alter the investment environment we’ve grown accustomed to over the past decade.

Three Dark Clouds Over the Financial Markets

The Sovereign Debt Crisis: My Greatest Concern

Let me be absolutely clear: the sovereign debt crisis is my greatest concern. The United States has public debt exceeding 100% of GDP. Britain faces similar challenges. We’re seeing massive deficits—in America, it’s somewhere between 6 and 8% of GDP this year, depending on how you calculate it. France has major problems. Japan has major problems. Italy has major problems.

The American federal government’s interest payments will soon reach 5% of GDP. That’s more than the Americans spend on defence. Think about that for a moment—roughly a quarter of all federal tax revenues will go to servicing debt. If interest rates rise, you can see how this becomes extremely difficult to manage.

Here’s the crucial calculation: if interest rates are higher than nominal GDP growth, you get an explosive development in debt as a percentage of GDP. Let’s say the American economy grows at 2% in real terms with 2% inflation—that’s 4% nominal GDP growth. If the interest rate on government debt is 5%, the debt burden will simply grow and grow and grow.

Donald Trump has talked extensively about growing out of the debt problems with all his brilliant ideas that will boost growth. Unfortunately, there’s little evidence this is happening. We got labour market figures last week that further confirm the American labour market is cooling, and GDP growth in the first half of the year is below one and a half percent annualised. The economy isn’t booming.

But there’s another way to get nominal growth up—create inflation. Every Danish homeowner who owned property in the 1970s can tell you this story. The high inflation of the 1970s ate away homeowners’ debt. And if you’re a government that creates inflation, perhaps by ringing up the central bank and saying “print some money,” well, that solves one problem whilst creating another.

The temptation to let the printing press run becomes greater and greater if you don’t want to make difficult decisions. We’ve seen Donald Trump at war with the Federal Reserve. He’s talked about firing Lisa Cook, who sits on the Federal Reserve Board—though last week the American Supreme Court told him, “You can’t do that, Donald. You need to argue your case better.” That’s been kicked to the corner for now. But the pressure is there. He’s said he won’t reappoint Jerome Powell when his term expires next year. He’s appointed Stephen Rennenkampf to the FOMC, the leading monetary policy body at the Federal Reserve. Rennenkampf, you’ll recall, voted for a half-percentage-point rate cut rather than the quarter-point cut we got at the last FOMC meeting. These are all signs of politicisation.

Geopolitical Uncertainty: The Highest in 35 Years

The geopolitical situation must be described as unstable and frightening—probably the highest level of uncertainty in at least 30 to 35 years. We’ve had the drones over Copenhagen, the entire situation in Europe, and recently there’s been speculation about whether the Chinese might make moves regarding a possible invasion of Taiwan. We have the conflict in the Middle East—Iran, Israel, Gaza—which creates concerns.

As I write this, we’re not far from Forum Copenhagen where we recently had a major European summit. I must be honest there was a lot of police around. Many helicopters in the air. We’ve heard a jet fighter or two. I have children asking about all this. What’s all this about? It’s rather uncomfortable on a practical level.

When this starts affecting air traffic, potentially sea transport, our supply chains, company earnings, and economic development, it becomes negative for markets. So far, markets have taken it remarkably calmly, but the threat is there.

We’ve agreed in Europe that we need to increase our defence spending because there’s a genuine threat from Putin’s Russia. There’s much talk about why there wasn’t drone defence around Copenhagen Airport and other Danish airports. Because there hasn’t been a need for it – it was completely unthinkable just a few years ago, but suddenly it’s something we must consider.

Drone defence isn’t free. I don’t know what it costs to send an F-16 fighter jet up to fire missiles at drones over Copenhagen Airport, but it’s not cheap. And whilst I hope it doesn’t come to that, it’s a stark illustration that we need to spend more on defence in Denmark and Europe in general.

If we already have weak public finances in Europe (much less so in Denmark), this pushes the problem further. We need more money, which pushes interest rates up. More government bonds need to be issued, and governments must pay those interest costs. If doubts arise about their willingness to pay, inflation expectations start rising too.

The Ukrainians are currently having some success pressuring the Russian economy by hitting oil refineries, oil storage, and other targets that push up petrol prices. Russian petrol prices have risen 40% this year. Petrol rationing has been introduced in many parts of Russia. We’re seeing images from Russia of kilometre-long queues because of rationing. It’s hitting the Russian economy.

There are probably quite a few Russians who are thoroughly fed up with this. We’re talking about Russian losses on the front over the past three years approaching a million men dead or wounded. So it’s not certain the war is quite as popular as some might wish. Perhaps someone would like to remove Putin. And let’s say that happens, and there’s a positive regime change in Russia. The geopolitical situation would change immediately, and perhaps we could reduce our fear that we need to spend 3-4-5% of GDP on defence. That picture changes if we’re facing a different Russia.

The Tech Concentration Risk

If we look at how the global equity market is constructed, somewhere between 70 and 80 percent of the global equity market – perhaps even more – consists of American shares. And a very large portion of that is just six or seven tech shares that dominate to an enormous degree.

So in reality, when you think you’re buying the whole world, you’re perhaps getting massive exposure to Nvidia, for example, or Tesla, or Microsoft. You’re exposing yourself enormously to American technology shares. And then you haven’t spread your risk—you think you have, but you haven’t really done so.

If these shares are overvalued – and it’s my personal opinion that they appear to be – then you haven’t spread your risk. You’ve actually taken on relatively high risk.

Let me give you an example of the timing problem. If we look at the situation in 1998 and examine the American stock market, we can see that American technology shares were extremely expensive at some point. If we look forward five years, we can see that was correct, and technology shares actually fell significantly during that period.

But here’s the problem: we need to find indicators that get us in and out of markets at the right time. I’ve done this exercise many times. Could we find indicators, such as price-earnings ratios—the share price relative to company earnings? Could we say that if price-earnings rises above a certain level, we should sell, and when it falls below another level, we should buy?

If we do this in connection with the tech bubble in the late 1990s, you’ll see it’s nearly impossible to find an indicator that would have got you out of the market at the right time and back in at the right time in real-time. The problem is that most indicators were already telling you to leave the market from 1995-1996. But if you left the market then, you’d have missed the entire upswing, and you’d be sitting there waiting for the market to come back down to where you started.

The best would be to stay in the market, even though it’s become too expensive, and then exit at the top. But if you don’t have an indicator for that, it’s useless. And so whilst I can sit here and say I think tech shares are really, really expensive now, and they’ve become very concentrated, that makes it very difficult to act on.

Governance as an Investment Strategy

When I talk about governance, it’s really about what we want when there’s uncertainty—trust. Something we can rely on. Perhaps in 2018 or 2019 or 2020, Russian shares looked very attractive. They were cheap, and there were some good stories. But there was also a dictator in Russia. A dictator who could suddenly just invade a neighbouring country and essentially confiscate all businesses. Hardly anyone would want to have invested in Russian shares today.

This governance theme has been really important in recent years. Countries where there’s respect for property rights, where there’s press freedom, where there’s a low level of corruption, where agreements are honoured, where the legal system ensures agreements are honoured—these are countries that have performed relatively better than those where we think, “Hmm, perhaps there’ll be a military dictatorship tomorrow, or the military dictator might confiscate some businesses.”

We can think of countries like Turkey, Russia, China. We’ve seen very clearly that this theme has dominated the pricing of Chinese shares. President Xi might decide to confiscate a business or introduce capital controls. And some of the things we’ve talked about regarding Donald Trump—that’s what we could broadly call governance. Because Donald Trump has said, “I didn’t write the rulebook. It doesn’t apply to me.” And something happens there.

Donald Trump constantly tests these checks and balances. He’s done it in trade, with the central bank, with defence, with states’ autonomy. He’s sent the National Guard into various states. He constantly tests this. And something we’ve talked about in various forms—whether we believe in these checks and balances—that there’s no problem, he can’t do anything. But he tests it. And he tests it extensively.

The countries that score highly on governance include lovely, peaceful, beautiful Denmark. If we look at various measures of economic and political freedom, all the Nordic countries, but especially Denmark, score very highly on economic freedom. We have relatively low levels of regulation, which might surprise some people. We have well-protected property rights. What pulls us down when we talk about economic freedom is that we have high tax levels in Denmark. But overall, we have relatively unregulated product markets, relatively unregulated labour markets.

Other countries could be Ireland, Singapore, Switzerland, the Netherlands—they typically score highly on these measures. These are countries where we’d also feel safe if we flew there. We won’t just be arrested on the street for nothing. That’s a large part of European countries, but not all of them.

There are also countries that have clearly moved in the right direction. If we look at all countries in Central and Eastern Europe, 35-36 years ago we had communist dictatorships in Poland, in the Baltics, for example. And we must say they’ve moved enormously regarding these governance questions, becoming free, democratic nations with respect for property rights.

If we look at emerging markets over the past five years, it’s been very clear that the emerging markets with most respect for institutions, property rights, contractual freedom, and free trade are the ones that have performed well. That could be Poland, the Baltics. But countries that have moved away from this—Russia, China, Turkey—have taken proper beatings in the stock market.

Chile and Uruguay are countries in the emerging markets world that belong at the top of the class. Botswana is interesting—I believe Botswana gained independence in 1966 and has been a democracy since independence. It’s actually the only country in Africa that can boast of this. It’s had enormous economic and political stability, democracy, and well-protected property rights. It’s a fantastic success story that we don’t talk much about.

The All-Weather Portfolio

What we need to consider is what’s sometimes called an all-weather portfolio – an investment portfolio that performs well in different weather conditions. When the economy is doing well, when it’s doing poorly, when there’s inflation, deflation, stable inflation, high growth, volatile growth. How do you manage?

It’s about spreading risk, of course. It’s also about having shares or assets that can handle these scenarios. My encouragement to investors sitting out there having made really good money on their shares would be: perhaps you should sit down and say you haven’t spread your risk. You thought you had because you just bought the S&P 500 index. But now you’ve become enormously exposed to basically five or eight American tech shares.

Perhaps you should reduce that exposure, buy some bonds, buy some commodities. It could be gold. It could be gold mining shares. It could be different types of bonds. It could be focusing on inflation risk—buying inflation-indexed bonds to remove some of that inflation risk. Spread the risk.

Saying “I have five different shares” isn’t enough if you’ve bought five different shares within the same sector—you haven’t spread the risk. You need different countries, different assets, bonds, shares. In reality, what you should do if you’re sitting there thinking you’re a bit worried things have become expensive, or you’re considering spreading risk, is to spread it across many more assets.

For the average Dane (or anybody else globally), the most significant exposure in their portfolio is the property or flat they own. It’s interesting that whilst we sit here with drones over Copenhagen, uncertainty, trade wars, and all sorts of things worrying us, Copenhagen property prices are up 20% over the past year. That tells a story about how the property market and stock market are insurance – partial insurance – against high inflation.

Where it’s not insurance is if central banks do something about inflation. If they say inflation is rising too much and we need to kill it by raising interest rates sharply, then the property market dies, the stock market dies. So we can’t just say we shouldn’t worry and should buy shares and bonds. What I’m trying to say is that when we start getting high inflation expectations, some of these markets begin to behave differently than we’re used to.

My Final Message: Don’t Panic, But Do Check Your Risk

My main message is: don’t panic. Use these crisis considerations to sit down calmly. Whether you’re an institutional investor, pension fund, or individual investor, sit down and ask: how am I actually exposed? Have I really achieved the risk diversification I think I have?

Because there are people who don’t need risk diversification. But sit down and do a crisis check, a risk diversification check on your portfolio. Don’t do anything desperate. Don’t think you know which crisis share or weapons share will rise. Don’t try to beat the market, but sit down and consider whether you have the risk diversification you think you have.

If you think you’ve spread your risk by just buying a global equity index, my message is: you haven’t spread your risk. You might feel like you have, and it’s actually performed really well. But this crisis might be a good reason to take that check. And don’t rush it. You never get anything good from that.

I’d like to be in a situation where I’d want to buy weapons shares because I’m worried—yes, there’s that too. I’m probably in the worried camp relative to how the market is. But if I’m constructing a portfolio, I need to create one where I don’t constantly have to time things correctly.

If your portfolio has risen 30% annually for the past three years, perhaps it might be good to spread some risk, get some bonds, get some commodities. That’s not investment advice in the sense that I don’t know what individuals have as exposure. I don’t know individual private economics, but this is what economic and financial theory textbooks say: spread your risk, consider the correlation between assets.

Sometimes you think, “I’m in this and I’m in that—they’re completely different things.” But if you see that nine out of ten days these two assets move in the same direction, you’ve essentially bought the same thing. So consider that. I think this is a healthy opportunity to do a reality check on your portfolio.

This article is based on the latest episode (“Investering i en krisetid) of my podcast “Makropuls” (in Danish). See links to the podcast here (Spotify and Apple podcast). The podcast is produced in cooperation with Howden Denmark.





Source link