Microsoft Cert Expiration
How will the certificates be updated?
Typically this is performed by the Operating System’s update manager (Windows updates, or the respective update manager in a Linux distribution), meaning that systems deployed in the field that receive regular OS updates most likely already have the new certificates enrolled. Alternatively for systems that may not have an internet connection, the new certificates can be enrolled manually
OS Specific Updates
Windows Updates
Microsoft has provided some info on how to audit your Secure Boot status in windows. The recommended update path for Windows users is to leverage Windows Updates to handle the new certificate enrollment.
Windows seems to not proactively check the Secure Boot policy unless Secure Boot is enabled. Customers that have Secure Boot enabled most likely have already received the new certificates in a previous Windows Update.
Linux
Update managers differ between linux distributions but ultimately rely on the fwupd tool to manage system firmware updates. If the fwupd command is not present in a linux OS, then the OS’s package manager can be used to install fwupd.
In Ubuntu, fwupd can be installed via:
Note: make sure fwupd is version 2.1.0 or later. Once installed the fwupdmgr can be used to query and initiate the certificate update:
Manual updates
Microsoft has made the new certificates available for download . Once downloaded customers will need to convert the x509 certificate (.crt file) into a DER encoded format (.cer file). This can be done with the openssl tool in Windows or Linux
The syntax for conversion is:
openssl x509 -outform DER -in <input_filename>.crt -out <output_filename>.cer
Example using one of the downloaded certificates:
Once converted, the .cer file can be placed on a USB flash drive and manually loaded in to the UEFI by going to the “Administer Secure Boot” menu, choosing the respective certificate repository (KEK, and db) and choosing “enroll”
After choosing the enroll option, navigate to the USB stick that has the DER formatted certificates and select it. You may be prompted for an owner UUID which is provided for each certificate on the Microsoft page.
Once enrolled the new certificate will show in the repository
Last updated