Your Secure Boot Keys Expired in June — Here's How to Check

If you're running Linux on hardware with Secure Boot enabled, there's a good chance Microsoft already renewed the shim loader signing keys in your firmware. But "good chance" isn't the same as "definitely."

Here's what you can do right now to audit your Secure Boot state.

Check if Secure Boot is even enabled

mokutil --sb-state

Enter fullscreen mode Exit fullscreen mode

This tells you whether Secure Boot is enabled, disabled, or not supported. If it's not enabled, you can stop reading.

See what's in your firmware db

The db key database is what your firmware uses to validate everything that boots before the OS. To list the signatures currently enrolled:

mokutil --db

Enter fullscreen mode Exit fullscreen mode

You'll see the Microsoft KEK and other keys. The shim loader (what loads GRUB on most Linux systems) was signed by a key that expired June 2026.

Why machines still boot

The keys are still in firmware. The firmware doesn't check expiry dates — it just looks for a matching signature. So nothing broke. But if you ever need to re-enroll keys or enroll new ones, you want to be working with current material.

Update your keys if needed

On Fedora and other EL-based systems:

sudo fwupdmgr update

Enter fullscreen mode Exit fullscreen mode

This pulls updated keys from the LVFS firmware database. On Ubuntu, check your shim-signed package is current:

apt list --upgradable | grep shim

Enter fullscreen mode Exit fullscreen mode

The practical takeaway

This isn't an emergency. It's housekeeping. If you manage a fleet of Linux workstations or servers with Secure Boot, worth adding a check to your provisioning scripts. The command is fast, and the output is clear.

mokutil --sb-state
echo "exit code: $?"

Enter fullscreen mode Exit fullscreen mode

Set it to alert if Secure Boot state doesn't match your expected baseline.

---

No dramatic warnings here. Just check, update if needed, move on.