> For the complete documentation index, see [llms.txt](https://support.onlogic.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.onlogic.com/support-articles/how-tos/firmware-bios-drivers/microsoft-cert-expiration.md).
# Microsoft Cert Expiration
### How will the certificates be updated?
Typically this is performed by the Operating System’s update manager (Windows updates, or the respective update manager in a Linux distribution), meaning that systems deployed in the field that receive regular OS updates most likely already have the new certificates enrolled. Alternatively for systems that may not have an internet connection, the new certificates can be enrolled manually
## OS Specific Updates
### Windows Updates
Microsoft has provided some info on how to audit your Secure Boot status in windows.
\
The recommended update path for Windows users is to leverage Windows Updates to handle the new certificate enrollment.
{% hint style="info" %}
\
Windows seems to not proactively check the Secure Boot policy unless Secure Boot is enabled. Customers that have Secure Boot enabled most likely have already received the new certificates in a previous Windows Update.
{% endhint %}
### Linux
Update managers differ between linux distributions but ultimately rely on the fwupd tool to manage system firmware updates. If the fwupd command is not present in a linux OS, then the OS’s package manager can be used to install fwupd.
In Ubuntu, fwupd can be installed via:
```
sudo snap install fwupd
```
Note: make sure fwupd is version 2.1.0 or later.
\
Once installed the fwupdmgr can be used to query and initiate the certificate update:
```
hx500@hx500-CometLake:~$ fwupdmgr get-updates
Updating lvfs
Downloading… [***]
Successfully downloaded new metadata:
<..>
├─UEFI CA:
│ │ Device ID: 5bc922b7bd1adb5b6f99592611404036bd9f42d0
│ │ Current version: 2011
│ │ Vendor: Microsoft (UEFI:Microsoft)
│ │ GUIDs: 26f42cba-9bf6-5365-802b-e250eb757e96 ← UEFI\VENDOR_Microsoft&NAME_Microsoft-UEFI-CA
│ │ c34a7e6a-bd86-5244-8bd0-7db66fd3c073 ← UEFI\CRT_E30CF09DABEAB32A6E3B07A7135245DE05FFB658
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Signed Payload
│ │ • Can tag for emulation
│ │
│ └─Secure Boot Signature Database Configuration Update:
│ New version: 2023
│ Remote ID: lvfs
│ Release ID: 116503
│ Summary: UEFI Secure Boot Signature Database
│ License: Proprietary
<..>
│ Description:
│ This updates the 3rd Party UEFI Signature Database (the "db") to the latest release from Microsoft.It also adds the latest OptionROM UEFI Signature Database update.
```
## Manual updates
Microsoft has made the new certificates [available for download ](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance?view=windows-11#14-signature-databases-db-and-dbx). Once downloaded customers will need to convert the x509 certificate (`.crt` file) into a DER encoded format (`.cer` file). This can be done with the openssl tool in Windows or Linux
The syntax for conversion is:
`openssl x509 -outform DER -in .crt -out .cer`
Example using one of the downloaded certificates:
```
openssl x509 -outform DER -in "microsoft corporation kek 2k ca 2023.crt" -out "microsoft corporation kek 2k ca 2023.cer"
```
Once converted, the .cer file can be placed on a USB flash drive and manually loaded in to the UEFI by going to the “Administer Secure Boot” menu, choosing the respective certificate repository (KEK, and db) and choosing “enroll”
After choosing the enroll option, navigate to the USB stick that has the DER formatted certificates and select it. You may be prompted for an owner UUID which is provided for each certificate on the [Microsoft page](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance?view=windows-11#14-signature-databases-db-and-dbx).
Once enrolled the new certificate will show in the repository