Is there a straightforward way to update Secure Boot certificates on Linux, or does it depend on the hardware and distribution? I also have some virtual machines and am not sure whether the guest or the host handles their certificates.
How do I update Secure Boot certificates on Linux?
Asked by
x6+tramline_302
Answers
There isn't one terminal command that works everywhere. Start by checking whether the machine boots in UEFI mode and whether Secure Boot is enabled. Then check your distribution's guidance for its Secure Boot certificate updates and your hardware vendor's firmware updates.
Some distributions may deliver updates through their normal update process, while firmware update availability varies by hardware. Updating the BIOS or UEFI firmware is worth checking, but don't assume that alone installed every certificate you need.
Reply to this answer
For a physical machine, fwupd and the Linux Vendor Firmware Service are worth a look if the hardware is supported. The available updates can be patchy, though, and an update may fail if the EFI system partition isn't found.
Check what updates are actually offered and verify the Secure Boot databases afterward. Installing a firmware update tool is not a guarantee that the certificate update is available for that machine.
Reply to this answer
On a UEFI system, mokutil can inspect the firmware trust databases. Try mokutil --db and mokutil --kek, then look through the output for the certificates you're checking. For example, you can search for UEFI CA 2023 in db and KEK 2K CA 2023 in KEK.
Those checks tell you what is present, not whether every update or revocation has been applied. Also, mokutil --list-enrolled shows Machine Owner Keys, which are separate from the firmware's db and KEK.
Reply to this answer
VMs need a separate check. The virtual firmware and its Secure Boot keys are managed according to the hypervisor's implementation, so don't assume the guest simply uses the physical host's certificates or that the guest can never update its own virtual firmware variables.
Check the hypervisor and guest distribution documentation for the supported update path, then inspect the databases inside the VM where possible. Updating the physical host and updating a VM's virtual Secure Boot state can be separate jobs.
Reply to this answer
I'd be careful about temporarily installing another OS just to push an update. A certificate or revocation change could affect whether the Linux bootloader is still trusted. Check compatibility and have a recovery plan before changing the Secure Boot databases.
Reply to this answer
Add your answer
Answers are reviewed before publication.
x6+tramline_302:
So a match is useful for checking those particular certificates, but it isn't a complete Secure Boot health check?
n418~mux_2:
Right. Check the relevant distribution and platform guidance for the rest, including any revocation updates and bootloader requirements.