The Upcoming Windows Secure Boot Certificate Expiration

[PaulH]

This could be a topic in an upcoming Security Now! podcast. It appears that secure boot certificates will expire in 2026, which may require a non-trivial update.

Secure Boot Certificate Expiration 2026: Update Your Windows Trust Chain

Windows Secure Boot certificate expiration and CA updates

Paul

 

[PaulH]

Microsoft is rolling out the updated secure boot certs. My Asus-based Windows 11 PC was updated a few days ago.

Microsoft to Roll Out New Secure Boot Certificates to Keep Old Windows PCs Secure​

 

[mdwnn]

Finally... They have been extremely slow at pushing these new certificates, even though BitLocker security has been broken since 2023. CVE-2023-21563 allowed anyone to bypass the BitLocker security because there is a vulnerable boot loader signed with the old secure boot certificates.

Windows BitLocker -- Screwed without a Screwdriver

Breaking up-to-date Windows 11 BitLocker encryption -- on-device but software-only

neodyme.io

 

[GreenWine]

I asked a friendly AI about this topic for Ubuntu based systems, not everyone runs Windows but many Linux distros use a Microsoft cert for Secure Boot. It suggested that I shouldn't be too worried and an update might to Ubuntu might address it, but wasn't sure. So that was not too helpful. I suppose I could always install Windows 11 in a small partition to get it updated, and then erase it again.

 

[PHolder]

Linux distros use a Microsoft cert for Secure Boot.

Yeah but is the OS itself ALSO secure booting? If not, you might as well just disable secure boot to begin with, and nothing is being gained by using it if it's not full chain from the boot all the way into the OS.

 

[GreenWine]

Yeah but is the OS itself ALSO secure booting? If not, you might as well just disable secure boot to begin with, and nothing is being gained by using it if it's not full chain from the boot all the way into the OS.

I installed it with SB enabled, so I believe so.

 

[PHolder]

I installed it with SB enabled, so I believe so.

I'm not an expert, but I think that many Linux distros just use a secure boot shim. It basically is signed to allow it to load via UEFI, and all it does is go forward and load the boot loader, which presumably doesn't care one way or the other or the shim would be unnecessary. So I think that's basically what you'd call a "workaround" and doesn't mean the OS is building on the secure boot chain.

 

[PHolder]

Of possible note is this note from March's patch Tuesday note: https://support.microsoft.com/en-us...044-7058-5738282d-0b7f-426e-a42b-bd7698ab6dbb

[Secure Boot] With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. This targeting is based primarily on client device diagnostic data; due to limited data, servers are unlikely to qualify, though not explicitly excluded. Devices receive new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout.

 

[mdwnn]

My test Dell laptop finally got the update, and the new certificates now prevent the Bitlocker bypass.

When I retry the attack now, the old boot manager stops at an empty blue screen instead of proceeding with the unlock of the drive.

 

[Consetti]

I had several computers that hadn't received the new certificates yet. I asked Copilot what if anything I could do to get the process going. The one step I was missing was to allow sending optional diagnostic data to Microsoft so they could check the status of my machines.

I normally disable sending telemetry and diagnostic data to Microsoft by using a program called O&O Shutup and, normally, that seems like a good idea but in this special case not so much. I allowed sending diagnostic data to Microsoft and I now have the new certs on my machines waiting for Microsoft to make them active.