If you're running Linux on hardware with Secure Boot enabled, there's a good chance Microsoft already renewed the shim loader signing keys in your firmware. But "good chance" isn't the same as "definitely."
Here's what you can do right now to audit your Secure Boot state.
Check if Secure Boot is even enabled
mokutil --sb-state
This tells you whether Secure Boot is enabled, disabled, or not supported. If it's not enabled, you can stop reading.
See what's in your firmware db
The db key database is what your firmware uses to validate everything that boots before the OS. To list the signatures currently enrolled:
mokutil --db
You'll see the Microsoft KEK and other keys. The shim loader (what loads GRUB on most Linux systems) was signed by a key that expired June 2026.
Why machines still boot
The keys are still in firmware. The firmware doesn't check expiry dates — it just looks for a matching signature. So nothing broke. But if you ever need to re-enroll keys or enroll new ones, you want to be working with current material.
Update your keys if needed
On Fedora and other EL-based systems:
sudo fwupdmgr update
This pulls updated keys from the LVFS firmware database. On Ubuntu, check your shim-signed package is current:
apt list --upgradable | grep shim
The practical takeaway
This isn't an emergency. It's housekeeping. If you manage a fleet of Linux workstations or servers with Secure Boot, worth adding a check to your provisioning scripts. The command is fast, and the output is clear.
mokutil --sb-state
echo "exit code: $?"
Set it to alert if Secure Boot state doesn't match your expected baseline.
No dramatic warnings here. Just check, update if needed, move on.
Top comments (0)