Secure Boot certificates expire in 2026 – what do I need to do? - TUXEDO Computers

The Secure Boot certificates issued by Microsoft in 2011 will expire in two waves in June and October 2026 and must be replaced. Otherwise, the Secure Boot trust chain used by UEFI firmware to verify whether a kernel or bootloader is allowed to start may break. This only affects systems where Secure Boot has to be actively enabled. We are informing our customers in advance about how to update these certificates if necessary. The expiration date of the Secure Boot certificates affects not only Windows users, but also Linux systems with Secure Boot enabled. However, we would also like to mention that we at TUXEDO recommend disabling Secure Boot.

How can I check if Secure Boot is enabled?

With Windows 10 or 11, press Windows+R, enter msinfo32 and confirm with Enter. In the window that appears, look for Secure Boot State. If it is set to Off, no action is required.

On Linux, you can check the same information using:

mokutil --sb-state

How can I renew my Secure Boot certificates?

The update is performed via a firmware update that contains the new Secure Boot keys. On TUXEDO devices (and many others), this update is distributed via the Linux Vendor Firmware Service (LVFS). Alternatively, you can also update the current keys via a BIOS update. You will find the relevant BIOS in your customer account in due course.

The required software package fwupd is preinstalled on TUXEDO OS. On other distributions, if necessary, install it using your distribution’s package manager. 

Perform the firmware update via LVFS

First, refresh the firmware metadata:

sudo fwupdmgr refresh

If you are using LVFS for the first time, you will need to confirm the connection. Simply confirm the prompts twice by pressing Enter.

Then search for available updates:

sudo fwupdmgr get-updates

If updates are listed, install them with:

sudo fwupdmgr update

After that, a reboot is mandatory, as the update is applied inside the UEFI firmware. Once the system has restarted, you can verify that Secure Boot is still enabled:

mokutil --sb-state

If you use Secure Boot, you should install the firmware update before June 2026.

What happens if I don’t install the update?

Without updated certificates, the following issues may occur:

• new bootloader versions may no longer start
• kernel updates with new signatures may be rejected
• the system may fail to boot after an update

Does the update also apply to Windows in a dual-boot setup?

The update always applies to the entire device, regardless of which operating system is installed or currently running. Secure Boot keys are stored in the UEFI firmware, not in the operating system. There is only one UEFI per device.

I don’t see any update. What does that mean?

New TUXEDO devices are already shipped with firmware that contains the new Secure Boot certificates (UEFI CA 2023). In this case, no further action is required.

You can verify this with:

mokutil --db | grep -i microsoft

You are up to date if the output contains UEFI CA 2023. The important part is the year 2023, which indicates when Microsoft issued the new certificates.

No update available, but the device is older?

Try again at a later time. Firmware updates are rolled out in stages.

If you still do not see an update by June 2026 and you use Secure Boot, please contact our support team. For more details on Secure Boot in general, please refer to our basic article on the topic.