Hello. Keys the shim is signed with since October 2025 are known to be ‘Microsoft Windows UEFI Driver Publisher’ (2011 year, expiration date June 24, 2026) and ‘Microsoft UEFI CA 2023 signer’ (2023 year). Once a certificate expires, despite existing signed components will still allow devices not stoping booting, it will result on that device in the loss of the ability to update the Secure Boot’s DBX, and then known vulnerabilities at boot level will be exploitable forever.
Interpretation of the firmware update status on a physical machine
$ sudo fwupdmgr update
Devices with the latest available firmware version:
• UEFI CA
• UEFI dbx
Devices with no available firmware updates:
• ASUSTeK KEK Certificate
• ASUSTeK SW Key Certificate
• HFS256G39TND-N210A
• Windows Production PCA
• KEK CA
• Master Certificate Authority
• Master Certificate Authority
• Option ROM UEFI CA
• SBAT
• System Firmware
It should be noted that no guarantee is given as to the reliability of the results, aggravated by the truncation of certificate/key peer names causing duplicate entries.
$ mokutil --short --db
62b51ed2e6 ASUSTeK Notebook SW Key Certificate
16b36b31bb ASUSTeK MotherBoard SW Key Certificate
46def63b5c Microsoft Corporation UEFI CA 2011
580a6f4cc4 Microsoft Windows Production PCA 2011
76a0920658 Canonical Ltd. Master Certificate Authority
b5eeb4a670 Microsoft UEFI CA 2023
3fb39e2b8b Microsoft Option ROM UEFI CA 2023
Do you happen to know if /boot/efi/EFI/fedora/shimx64.efi on Fedora 44 is supposed to be signed with the ‘Microsoft UEFI CA 2023 signer’? On my system ‘pesign -S’ shows it is not. There ‘Microsoft Windows UEFI Driver Publisher’ is alone the signer.
Do you happen to know why each time when invoking ‘pesign -S’, certificate addresses “0x7f__________” vary?