Welcome to the Forum!
Because You have W10 Machines, this could be a Problem because W10 is EOL. So, it doesn't geat any Updates. Disabling Secure Boot and TPM should be the easiest Thing to do in this Situation in my Opinion. The UEFI Mode in BIOS, You can let enabled.
Yes, thanks, I did receive those updates last night and noticed they were related to this issue.
Check this out:
Yes, based on what you've described, these Microsoft Secure Boot certificate updates shouldn't affect you. Since you disabled Secure Boot before installing Zorin, kept it disabled after removing Windows, and even removed the existing Secure Boot certificates, your system isn't relying on Microsoft's Secure Boot infrastructure to boot. As long as Secure Boot remains disabled, these changes are essentially irrelevant to your current setup.
The only situation where they might matter is if you decide to re-enable Secure Boot in the future. In that case, you'd need to make sure the necessary keys and certificates are present and compatible with your Linux installation.
Good but None
As I explained in my detailed post, updating will allow dual booting. I even explained how to go to the manufacturers support page to get the firmware updates required if someone has disabled updates, or they fail to be provided for whatever reason.
Hi, was the detail in other thread?
@wsmather I have been looking more into this, and the issue in part is due to the fact that there have been noted vulnerabilities in .efi shims
Their is a Linux alternative, LibreBoot which uses CoreBoot as its base, but appears to be limited to specific notebooks. As a mere mortal I would not know where to begin to adopt it and would not want to brick my system.
The issue is around bootkits. I used Brave A.I. with past month criteria for period of time:
" The primary attack vector allowing bootkits into Linux EFI shims is the LogoFAIL vulnerability (a UEFI firmware flaw), which allows attackers to embed malicious shellcode in logo images to exploit out-of-bounds writes and modify the Machine Owner Key (MOK) list at runtime. This unauthorized modification effectively authorizes self-signed or malicious bootloaders (such as Bootkitty or BlackLotus ) to bypass Secure Boot integrity checks without user interaction. Additionally, vulnerabilities in GRUB2 (such as those allowing arbitrary code execution in grub.cfg ) and shim (CVE-2024-7344, which bypassed signature verification via a custom PE loader) provide further entry points for remote or local attackers to inject malicious code into the boot chain.
To protect against these bootkits, you should disable or avoid using HTTP Boot and PXE boot if not strictly necessary, as these features can be exploited to chainload malicious shims from remote servers. It is critical to use your own custom Secure Boot keys exclusively rather than relying on Microsoftâs third-party certificates, which have been compromised in past exploits; this prevents attackers from abusing trusted Microsoft-signed binaries. Furthermore, avoid using fwupd for automatic firmware updates and instead perform manual firmware image updates to prevent attackers from placing malicious logo images or binaries on the EFI System Partition (ESP) via firmware update mechanisms. Finally, ensure your EFI partition is read-only or unmounted in everyday situations to limit the ability of local root users or malware to overwrite critical bootloader binaries like grubx64.efi .
AI-generated answer. Please verify critical facts."
And:
How do custom Secure Boot keys work?
Custom Secure Boot keys work by replacing or supplementing the default manufacturer keys (typically Microsoftâs) with a user-generated key hierarchy , allowing you to establish your own Root of Trust rather than relying on third-party vendors. This process involves generating four specific key types that form a strict cryptographic chain: the Platform Key (PK) , which is the ultimate root owned by you; the Key Exchange Key (KEK) , which authorizes updates to the signature databases; the Signature Database (db) , containing public keys of allowed bootloaders; and the Forbidden Signature Database (dbx) , listing revoked keys.
When you implement custom keys, you typically enter Setup Mode in your UEFI firmware to clear existing keys, then generate and enroll your own PK, KEK, and db keys. Once enrolled, the firmware will only execute bootloaders, kernels, and drivers that are cryptographically signed by your private keys. This prevents attackers from exploiting vulnerabilities in Microsoft-signed binaries (like the shim or GRUB2) because those third-party signatures are no longer trusted by your system unless you explicitly choose to append them. Tools like sbctl on Arch Linux or pesign on RHEL automate the generation of these X.509 certificates and the signing of binaries like vmlinuz and grubx64.efi .
It is crucial to distinguish custom Secure Boot keys from Machine Owner Keys (MOK) . MOKs are a shim-specific mechanism that allows users to enroll keys for kernel modules (like NVIDIA drivers) without modifying the firmwareâs actual db; they rely on the existing Microsoft-signed shim to validate the MOK enrollment request. In contrast, custom Secure Boot keys replace the firmwareâs root of trust entirely, removing the dependency on Microsoftâs infrastructure and providing a higher security posture against supply-chain attacks targeting the default key hierarchy."
Does anyone know what happens to computers running Windows 11 that have bypassed the hardware check (Windows hack) because they aren't officially supported and have no TPM2 chip? Iâve installed all the updates in Windows, but under Device Security it says: âSecure Boot is enabled, but automatic updating of the Secure Boot certificate is not supported by your device due to hardware or firmware limitations. Contact the device manufacturer for support.
Standard hardware security is not supported."
The latest BIOS update on the manufacturerâs website is from 2020.
When I check if the new certificates are enabled, the power shell shows false.
At means, that You don't get the Secure Boot Update from Windows. You would have to make a BIOS Update. But when that isn't available, You don't have the Update.
Had until begin of this year 2 ten years old MSI Laptops Win11 TMP2 incompatible laptops in use configured as dual boot with Win11 24H2 and Zorin OS 18 Pro. As I disabled Win Updates, I forced the installation of the secure boot keys manual. Therefore I enabled secure boot in UEFI for this action, and disabled it afterwards. I hope this will still work as MS often closed workarounds. Please find it here:
Here you will find a simple and reliable method for installing the new Secure Boot keys 2023 on Windows. Worked successfully on Windows systems. The best option if you are using ZorinOS and Windows in dual-boot mode.
Please open an administrator terminal in Windows. Enter the following PowerShell commands in the terminal:
To check if the keys are already installed, enter the following exactly:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
If the output string is displayed as "True", the keys are already installed.
If the message "False" appears, it means that the keys are not present in the UEFI, and you can install them as follows:
First, a registry key must be set that instructs Windows to search for new secure startup keys. To do this, run the following command:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0x5944
The scheduled task for a secure boot key update will then be executed:
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
The PC must then be restarted twice to ensure the key update was successful. After each restart, the check should be performed again to confirm that the output is "True" and the new 2023 boot keys are installed.
Thank you very much, I'll try that. The first command showed false when I ran it this morning.
Edit: The secure boot update was successful. Now there is shown "true". 
That really helped me! I appreciate your advice.
happy to hear that!
You can see the secure boot key for windows Windows UEFI CA 2023 with this PowerShell command:
[System. Text. Encoding] : : ASCII. GetString((Get-SecureBootUEFI db) . bytes) -match 'Windows UEFI CA 2023'
True
You can see the secure boot key for Linux Microsoft UEFI CA 2023 with this PowerShell command:
[System. Text. Encoding] : : ASCII. GetString( (Get-SecureBootUEFI db) .bytes) -match 'Microsoft UEFI CA 2023
True
These two Secure Boot Keys 2023, for both Windows and Linux, are registered after the forced key update described above.
Can you please help me with my other old notebook (Wortmann Terra Mobile 1548Q) on which only Linux Mint 21.3 XFCE is installed. I want to update the Microsoft certificates. They are from 2011. I tried to update with fwupdmgr and there were shown no errors, but it seems not have to worked and there was shown "Devices with no available firmware updates: KEK CA, Windows Production PCA, SBAT, System firmware."
I installed the app gnome-firmware but I don't know how to use it. There are shown Microsoft UEFI CA, Microsoft KEK CA and some others, but everywhere is shown "Update error: getting efivars free space is not supported". I'm not sure if it works in XFCE. There are no buttons to start a firmware update.
You can try:
*****Check Secure Boot Certs in UEFI Firmware on Linux *****
sudo mokutil --kek (Shows Certificates in the KEK Database for SB)
sudo mokutil --db (Shows Cerificates in the Active Database for SB)
--------------- Check and install UEFI Firmware Updates on Linix --------------
sudo fwupdmgr refresh --> Checks if firmware is up to date
sudo fwupdmgr get-updates --> Displays what updates are available for firmware devices
sudo fwupdmgr update --> Updates firmware for devices where firmware updates are available
Also watch this on Youtube as it goes over BOTH Linux & Windows:
Dear Forpli,
Although I have extensive IT experience, I'm a Linux beginner and not yet familiar with the fwupdmgr commands. Experienced Linux users will surely be happy to help you with that; I simply lack the necessary know-how.
Regarding your Secure Boot Keys 2023 installation in general:
Ya Things will get interesting around the 24 th of june...or they wont...wont know till it happens anyone remember the 2k chaos? maybe something or maybe not i only use linux and have lateset bios and have secure boot off so may not even see anything at all.. so hold on to your seats folks...its gonna be a bumpy ride...or not....lol
Yes, I can disable secure boot in the BIOS.
To install Windows again would be another option, but I always have huge problems with the nvidia graphics drivers.
Not too long ago, I uninstalled Windows 11 from the device, which I had installed using a workaround with Rufus. Unfortunately, I didn't think to take care of the certificates beforehand. Now I thought it would be a good idea to install them, in case I pass the device on or might want to install Windows on it again later. I donât use Secure Boot on Linux itself; I only enabled it now specifically in case itâs needed for the update.
Perhaps someone else has an idea.
Thank you very much for taking the time to help!
Thanks for your suggestions. I had already tried all of those commands. Unfortunately, the certificates weren't installed.
There would be the Question if Mint 21 brings the Updates. Did You checked the Package Versions?
I just checked. They're the same already updated versions as shown on your screenshot (libfwupd3, fwupd, libxmlb2). They have the same versions numbers, but end with 22.04 for jammy.
I've now found a guide here for a similar Wortmann notebook...
The download links don't look very trustworthy, and I don't find a website where Microsoft offers the certificates for download.
I'm not sure if this will work, since my laptop unfortunately starts beeping loudly in the BIOS after just a few seconds and then shuts down. Maybe the BIOS is corrupted (a retailer once sent me files to flash the BIOS because the company where I bought the device no longer existed), or the motherboard or something similar is broken.
The fact that itâs so complicated (downloading the certificates doesnât even seem to work under Windows as mentioned in the link) is totally lousy. Never again I'll buy a Wortmann computer! Not a single BIOS update to download on the manufacturers site.
I tried to boot from ventoy with Hiren's boot cd to run Windows from the USB and saw the screen, but the laptop started beeping loud and shutdown. I think I can only boot with safe graphics mode. Something is defective.
