Typically this is performed by the Operating System’s update manager (Windows updates, or the respective update manager in a Linux distribution), meaning that systems deployed in the field that receive regular OS updates most likely already have the new certificates enrolled. Alternatively for systems that may not have an internet connection, the new certificates can be enrolled manually
OS Specific Updates
Windows Updates
Microsoft has provided some info on how to audit your Secure Boot status in windows.
The recommended update path for Windows users is to leverage Windows Updates to handle the new certificate enrollment.
Windows seems to not proactively check the Secure Boot policy unless Secure Boot is enabled. Customers that have Secure Boot enabled most likely have already received the new certificates in a previous Windows Update.
Linux
Update managers differ between linux distributions but ultimately rely on the fwupd tool to manage system firmware updates. If the fwupd command is not present in a linux OS, then the OS’s package manager can be used to install fwupd.
In Ubuntu, fwupd can be installed via:
sudo snap install fwupd
Note: make sure fwupd is version 2.1.0 or later.
Once installed the fwupdmgr can be used to query and initiate the certificate update:
hx500@hx500-CometLake:~$ fwupdmgr get-updates
Updating lvfs
Downloading… [***]
Successfully downloaded new metadata:
<..>
├─UEFI CA:
│ │ Device ID: 5bc922b7bd1adb5b6f99592611404036bd9f42d0
│ │ Current version: 2011
│ │ Vendor: Microsoft (UEFI:Microsoft)
│ │ GUIDs: 26f42cba-9bf6-5365-802b-e250eb757e96 ← UEFI\VENDOR_Microsoft&NAME_Microsoft-UEFI-CA
│ │ c34a7e6a-bd86-5244-8bd0-7db66fd3c073 ← UEFI\CRT_E30CF09DABEAB32A6E3B07A7135245DE05FFB658
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Signed Payload
│ │ • Can tag for emulation
│ │
│ └─Secure Boot Signature Database Configuration Update:
│ New version: 2023
│ Remote ID: lvfs
│ Release ID: 116503
│ Summary: UEFI Secure Boot Signature Database
│ License: Proprietary
<..>
│ Description:
│ This updates the 3rd Party UEFI Signature Database (the "db") to the latest release from Microsoft.It also adds the latest OptionROM UEFI Signature Database update.
Manual updates
Microsoft has made the new certificates . Once downloaded customers will need to convert the x509 certificate (.crt file) into a DER encoded format (.cer file). This can be done with the openssl tool in Windows or Linux
The syntax for conversion is:
openssl x509 -outform DER -in <input_filename>.crt -out <output_filename>.cer
Example using one of the downloaded certificates:
Once converted, the .cer file can be placed on a USB flash drive and manually loaded in to the UEFI by going to the “Administer Secure Boot” menu, choosing the respective certificate repository (KEK, and db) and choosing “enroll”
After choosing the enroll option, navigate to the USB stick that has the DER formatted certificates and select it. You may be prompted for an owner UUID which is provided for each certificate on the .
Once enrolled the new certificate will show in the repository
openssl x509 -outform DER -in "microsoft corporation kek 2k ca 2023.crt" -out "microsoft corporation kek 2k ca 2023.cer"
