only effects those using duel boot or has secure boot enabled. disabling this will cause this to not effect you
10 posts were split to a new topic: Secure Boot Certificate expiration effects
Good timing. Decided I would add an administrator and user password in the BIOS.
Another step to take, I have Windows 10 Pro on a separate drive. I have disabled Windows Boot Manager in the BIOS and changed the CSM settings to Legacy only.
This helps me to boot into Q4OS without having to boot into BIOS everytime to choose the hotswap bay.
It would be nice if this thread was made a "sticky" post, always at the top of "Latest posts" so it doesn't get overlooked.
It would be nice if there would be an article which can be translated for users who don't understand the English video.
1 Like
I think there is a bit of a misunderstanding going on here, maybe a bit of drama and click-bait too.
At the end of June, probably the 27th, UEFI CA 2011 and KEK CA 2011 certificates will expire. These 15 year-old certificates were compatible with Linux but will become "un-trusted" after the new ones become mandatory. This could cause incompatibility. However, it should be noted that Ubuntu, Fedora, RHEL, etc., are currently shipping "dual-signed" bootloaders (signed by both 2011 and 2023 keys). Ref: Red Hat , Fedora , and Rocky Linux. Zorin OS uses the shim-signed package from Ubuntu repositories, which from early 2026, Ubuntu has begun transitioning to multi-signed shims (both 2011 and 2023 signatures too), but older installation media or unupdated systems may still rely primarily on the expiring 2011 key. (I've checked this info in "Ask Ubuntu").
The good news is that if you're dual booting with Windows anyway, your machine should recieve the firmware updates automatically (or at least you can search for and enable them). However, if the manufacturer of your motherboard doesn't provide them you can do it manually (recommended).
Identify the make and model of your motherboard. Go to the official support website and download the latest BIOS/UEFI update released in 2025 or 2026 . The release notes should explicitly mention "Secure Boot," 2023. I've done this on my DELL laptop, it was quick and easy.
Use Powershell to check that your device is up to date. I'll copy the instructions here:
Open PowerShell as Administrator and run the following commands one by one. Each should return True :
# Check for the new KEK certificate
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).bytes) -match 'Microsoft Corporation KEK 2K CA 2023')
# Check for the new DB certificates
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Option Rom UEFI CA 2023')
------------ (I can't get the formatting right from here on, sorry!!):
If any command returns **False** , your firmware or Windows update process hasn't applied the necessary certificates yet, so you'll have to do it via your device's support website.
If your device is older (6 + years), as many are, as has been previously recommended by a lot of contributors to this post, disabling Secure Boot is the way to go.
1 Like
I think you can "auto-dub" them inside YouTube. I had problems with my old Chinese-made phone that is very popular in India. I found out how to fix it by watching videos dubbed into English.
@swarfendor437 i currently dont have that ability maybe we can poke @StarTreker and get this done im only a regular need a community leader or higher for that.... 
And just to be clear here secure boot is not required to be on to use linux and you dont really gain much from having it on...but from what im hearing and ill guess we will see when microslop issues the new certs if duel booters suddenly lose ability to boot in to linux...if that happens a desision will need to be made is all commit to using linux full time and dumping microslop or tying to work around this possible delima guess will see what happens i know there is a thread in forum of a person trying to get linux to boot but the machine they are using maybe a windows only type and it WILL igrone the linux booter
heres link to it
1 Like
Auch wenn es unter Linux am besten ist, Secure Boot im UEFI zu deaktivieren, wodurch Secure Boot Keys nicht mehr benötigt werden... und viele mögliche Probleme vermieden werden...
Hier finden Sie eine einfache und zuverlässige Methode zur Installation der neuen Secure Boot Keys 2023 unter Windows. Funktioniert erfolgreich auf Windows-Systemen. Die beste Option, wenn Sie ZorinOS und Windows im Dual-Boot-Modus verwenden.
Bitte öffnen Sie ein Administrator-Terminal unter Windows. Geben Sie im Terminal die folgenden PowerShell-Befehle ein:
Um zu prüfen, ob die Schlüssel bereits installiert sind, geben Sie genau Folgendes ein:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
Wenn die ausgegebene Zeichenkette als „True“ angezeigt wird, sind die Schlüssel bereits installiert.
Falls die Meldung „False“ erscheint heißt das, dass die Schlüssel im UEFI nicht vorhanden sind, und Sie können sie wie folgt installieren:
Zunächst muss ein Registrierungsschlüssel festgelegt werden, der Windows anweist, nach neuen sicheren Startschlüsseln zu suchen. Führen Sie dazu folgenden Befehl aus:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0x5944
Anschließend wird die geplante Aufgabe für ein sicheres Startschlüssel-Update ausgeführt:
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
Der PC muss anschließend zweimal neu gestartet werden, um sicherzustellen, dass das Key Update erfolgreich war. Nach jedem Neustart sollte die Überprüfung erneut durchgeführt werden, um zu bestätigen, dass die Ausgabe „True“ lautet und die neuen Boot-Schlüssel 2023 installiert sind.
1 Like
Thread Pin's are intended for threads that are announcements that need to reach the broad audience.
This puts the focus on the thread being Accurate and not a hot topic but a Grounded topic.
If this thread is to be maintained as a Pinned Topic, then we will need to split this thread, with the pinned topic providing accurate information and staying level.
A secondary discussion thread can wax speculatively.
EDIT:
Topic has now been split. This pinned thread carries the notification along with posts that address preventative care.
3 Likes
You can also check SB Certs in Linux:
********** Check Secure Boot Certs in UEFI Firmware in Linux ************
sudo mokutil --kek
sudo mokutil --db
2 Likes
Within YT you can enable Subtitle (Untertitel) in your own language.
Therefore hover your mouse cursor over the bottom right corner of the YouTube video. Then click on the settings gear (Zahnrad) sign in the under right corner of the YT video. This will popup a menu: here click on Subtitle (Untertitel) like this:
Here click on "Englisch (automatisch erzeugt)":
Then choose Translate automatically "Automatisch übersetzen"
Here you can choose your desired language:
When you start the YT video it will show the subtitle:
1 Like
Ah, with your help I found the setting now! That is really helpful.
********** Check Secure Boot Certs in UEFI Firmware in Linux ************
sudo mokutil --kek
sudo mokutil --db
If I put this in terminal, what answer am I looking for that tells me my certificates are up to date?
How to tell in my Zorin has the certificates?
There is shown a date indicating how long the certificates are valid.
All I get is a big box of small numbers
7c:fe:94:a7:4e:8e:f4:ec:7c:86:73:57:c2:52:21:73:34:5a:
f3:a3:8a:56:c8:04:da:07:09:ed:f8:8b:e3:ce:f4:7e:8e:ae:
f0:f6:0b:8a:08:fb:3f:c9:1d:72:7f:53:b8:eb:be:63:e0:e3:
3d:31:65:b0:81:e5:f2:ac:cd:16:a4:9f:3d:a8:b1:9b:c2:42:
d0:90:84:5f:54:1d:ff:89:ea:ba:1d:47:90:6f:b0:73:4e:41:
9f:40:9f:5f:e5:a1:2a:b2:11:91:73:8a:21:28:f0:ce:de:73:
39:5f:3e:ab:5c:60:ec:df:03:10:a8:d3:09:e9:f4:f6:96:85:
b6:7f:51:88:66:47:19:8d:a2:b0:12:3d:81:2a:68:05:77:bb:
91:4c:62:7b:b6:c1:07:c7:ba:7a:87:34:03:0e:4b:62:7a:99:
e9:ca:fc:ce:4a:37:c9:2d:a4:57:7c:1c:fe:3d:dc:b8:0f:5a:
fa:d6:c4:b3:02:85:02:3a:ea:b3:d9:6e:e4:69:21:37:de:81:
d1:f6:75:19:05:67:d3:93:57:5e:29:1b:39:c8:ee:2d:e1:cd:
e4:45:73:5b:d0:d2:ce:7a:ab:16:19:82:46:58:d0:5e:9d:81:
b3:67:af:6c:35:f2:bc:e5:3f:24:e2:35:a2:0a:75:06:f6:18:
56:99:d4:78:2c:d1:05:1b:eb:d0:88:01:9d:aa:10:f1:05:df:
ba:7e:2c:63:b7:06:9b:23:21:c4:f9:78:6c:e2:58:17:06:36:
2b:91:12:03:cc:a4:d9:f2:2d:ba:f9:94:9d:40:ed:18:45:f1:
ce:8a:5c:6b:3e:ab:03:d3:70:18:2a:0a:6a:e0:5f:47:d1:d5:
63:0a:32:f2:af:d7:36:1f:2a:70:5a:e5:42:59:08:71:4b:57:
ba:7e:83:81:f0:21:3c:f4:1c:c1:c5:b9:90:93:0e:88:45:93:
86:e9:b1:20:99:be:98:cb:c5:95:a4:5d:62:d6:a0:63:08:20:
bd:75:10:77:7d:3d:f3:45:b9:9f:97:9f:cb:57:80:6f:33:a9:
04:cf:77:a4:62:1c:59:7e
Is that all? Have you tried scrolling up? The numbers are the end of the terminal output.