Secure Boot certificate changes (June 2026) #50

f750gs · 2026-03-18T09:47:16Z

f750gs
Mar 18, 2026

Hello

I use Aeon in fallback mode, secure boot enabled, on a Dell Optiplex 3060 Micro (DOM 2019).

fwupdmgr is showing a successfull Key Exchange Key (KEK) update from 2011 to 2023.
mokutil doesn't show any update to a 2023 version.

Will I run into problems after June 2026?

Thanks in advance.

fwupdmgr get-updates
Devices with no available firmware updates:
 • Internal SPI Controller (BIOS)
 • KEK CA
 • Key Exchange Key
 • MZ7LN256HCHP-000H1
 • PCH SPI Controller
 • SBAT
 • SSDSCKKF128G8 SATA 128GB
 • TS250GESD270C
 • UEFI DB
 • Windows Production PCA
Apparaten met de nieuwste beschikbare firmware-versie:
 • System Firmware
────────────────────────────────────────────────
Devices that have been updated successfully:
 • UEFI dbx (20160809 → 20250902)
 • UEFI CA (2011 → 2023)
 • KEK CA (2011 → 2023)

mokutil --kek
[key 1]
Owner: 70564dce-9afc-4ee3-85fc-949649d7e45c
SHA1 Fingerprint: d4:88:46:08:ae:a4:42:43:3c:f0:6e:5a:21:64:bf:f8:d3:d3:10:d6
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:9b:ad:52:bf:5d:ab:b2:4c:36:77:42:f4:eb:ac:cd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Texas, L=Round Rock, O=Dell Inc., CN=Dell Inc. Platform Key
        Validity
            Not Before: Jun  1 20:22:48 2016 GMT
            Not After : Jun  1 20:32:47 2023 GMT
        Subject: C=US, ST=Texas, L=Round Rock, O=Dell Inc., CN=Dell Inc. Key Exchange Key
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:

[value deleted by me]

                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Certificate Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier: 
                46:6F:90:1C:10:20:52:99:56:15:EF:39:FD:48:18:48:CF:75:E6:A4
            X509v3 Subject Key Identifier: 
                07:07:F4:95:10:D4:D7:7B:CF:DD:98:63:B5:FE:3C:60:72:A0:EA:72
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:

[value deleted by me]

[key 2]
Owner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
SHA1 Fingerprint: 31:59:0b:fd:89:c9:d7:4e:d0:87:df:ac:66:33:4b:39:31:25:4b:30
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:0a:d1:88:00:00:00:00:00:03
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation Third Party Marketplace Root
        Validity
            Not Before: Jun 24 20:41:29 2011 GMT
            Not After : Jun 24 20:51:29 2026 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation KEK CA 2011
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:

   [value deleted by me]

               Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                62:FC:43:CD:A0:3E:A4:CB:67:12:D2:5B:D9:55:AC:7B:CC:B6:8A:5F
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                45:66:52:43:E1:7E:58:11:BF:D6:4E:9E:23:55:08:3B:3A:22:6A:A8
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicCorThiParMarRoo_2010-10-05.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicCorThiParMarRoo_2010-10-05.crt
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:

       [value deleted by me]

Answered by f750gs

Mar 19, 2026

mokutil --db does show two new keys . Key 4 and 5

mokutil --db
[key 1]
Owner: 70564dce-9afc-4ee3-85fc-949649d7e45c
SHA1 Fingerprint: 15:25:4b:19:9b:df:c1:4f:e1:2f:6b:1a:b1:e6:f5:e7:b8:3d:6c:8b
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:e4:c5:11:d0:dc:09:ae:4d:9c:ec:51:5b:17:b1:f7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Texas, L=Round Rock, O=Dell Inc., CN=Dell Inc. Key Exchange Key
        Validity
            Not Before: Jun  3 14:26:06 2016 GMT
            Not After : Jun  3 14:36:05 2018 GMT
        Subject: C=US, ST=Texas, L=Round Rock, O=Dell Inc., CN=Dell Inc. UEFI DB
        Subject Public Key Info:
  …

View full answer

f750gs · 2026-03-19T17:24:01Z

f750gs
Mar 19, 2026
Author

mokutil --db does show two new keys . Key 4 and 5

mokutil --db
[key 1]
Owner: 70564dce-9afc-4ee3-85fc-949649d7e45c
SHA1 Fingerprint: 15:25:4b:19:9b:df:c1:4f:e1:2f:6b:1a:b1:e6:f5:e7:b8:3d:6c:8b
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:e4:c5:11:d0:dc:09:ae:4d:9c:ec:51:5b:17:b1:f7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Texas, L=Round Rock, O=Dell Inc., CN=Dell Inc. Key Exchange Key
        Validity
            Not Before: Jun  3 14:26:06 2016 GMT
            Not After : Jun  3 14:36:05 2018 GMT
        Subject: C=US, ST=Texas, L=Round Rock, O=Dell Inc., CN=Dell Inc. UEFI DB
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
     
[value deleted by me]
               
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: 
                Code Signing
            X509v3 Authority Key Identifier: 
                07:07:F4:95:10:D4:D7:7B:CF:DD:98:63:B5:FE:3C:60:72:A0:EA:72
            X509v3 Subject Key Identifier: 
                5D:DB:77:2D:C8:80:66:00:55:BA:0B:C1:31:88:6B:B6:30:A6:39:E7
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:

[value deleted by me]
        
[key 2]
Owner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
SHA1 Fingerprint: 46:de:f6:3b:5c:e6:1c:f8:ba:0d:e2:e6:63:9c:10:19:d0:ed:14:f3
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:08:d3:c4:00:00:00:00:00:04
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation Third Party Marketplace Root
        Validity
            Not Before: Jun 27 21:22:45 2011 GMT
            Not After : Jun 27 21:32:45 2026 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:

     [value deleted by me]
               
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                .....
            1.3.6.1.4.1.311.21.2: 
                ....k..wSJ.%7.N.&{. p.
            X509v3 Subject Key Identifier: 
                13:AD:BF:43:09:BD:82:70:9C:8C:D5:4F:31:6E:D5:22:98:8A:1B:D4
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                45:66:52:43:E1:7E:58:11:BF:D6:4E:9E:23:55:08:3B:3A:22:6A:A8
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicCorThiParMarRoo_2010-10-05.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicCorThiParMarRoo_2010-10-05.crt
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        
[value deleted by me]

[key 3]
Owner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
SHA1 Fingerprint: 58:0a:6f:4c:c4:e4:b6:69:b9:eb:dc:1b:2b:3e:08:7b:80:d0:67:8d
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:07:76:56:00:00:00:00:00:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
        Validity
            Not Before: Oct 19 18:41:42 2011 GMT
            Not After : Oct 19 18:51:42 2026 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:

[value deleted by me]
                    
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                A9:29:02:39:8E:16:C4:97:78:CD:90:F9:9E:4F:9A:E1:7C:55:AF:53
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                D5:F6:56:CB:8F:E8:A2:5C:62:68:D1:3D:94:90:5B:D7:CE:9A:18:C4
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:

[value deleted by me]        

[key 4]
Owner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
SHA1 Fingerprint: b5:ee:b4:a6:70:60:48:07:3f:0e:d2:96:e7:f5:80:a7:90:b5:9e:aa
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:16:36:bf:36:89:9f:15:75:cc:00:00:00:00:00:16
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Microsoft Corporation, CN=Microsoft RSA Devices Root CA 2021
        Validity
            Not Before: Jun 13 19:21:47 2023 GMT
            Not After : Jun 13 19:31:47 2038 GMT
        Subject: C=US, O=Microsoft Corporation, CN=Microsoft UEFI CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:

[value deleted by me]
                   
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                81:AA:6B:32:44:C9:35:BC:E0:D6:62:8A:F3:98:27:42:1E:32:49:7D
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                84:44:86:06:00:98:3F:2C:AA:B3:C5:89:F3:AC:2E:C9:E6:9D:09:03
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Devices%20Root%20CA%202021.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Devices%20Root%20CA%202021.crt
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:

[value deleted by me]       

[key 5]
Owner: 77fa9abd-0359-4d32-bd60-28f4e78f784b
SHA1 Fingerprint: 3f:b3:9e:2b:8b:d1:83:bf:9e:45:94:e7:21:83:ca:60:af:cd:42:77
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:17:b3:ec:4d:8f:01:e2:70:05:00:00:00:00:00:17
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Microsoft Corporation, CN=Microsoft RSA Devices Root CA 2021
        Validity
            Not Before: Oct 26 19:02:20 2023 GMT
            Not After : Oct 26 19:12:20 2038 GMT
        Subject: C=US, O=Microsoft Corporation, CN=Microsoft Option ROM UEFI CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:

[value deleted by me]
                    
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                51:4F:BF:93:7F:A4:6F:B5:7B:F0:7A:F8:BE:D8:4B:3B:86:4B:17:11
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                84:44:86:06:00:98:3F:2C:AA:B3:C5:89:F3:AC:2E:C9:E6:9D:09:03
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Devices%20Root%20CA%202021.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Devices%20Root%20CA%202021.crt
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        
[value deleted by me]

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Secure Boot certificate changes (June 2026) #50

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Secure Boot certificate changes (June 2026) #50

Uh oh!

Uh oh!

f750gs Mar 18, 2026

Replies: 1 comment

Uh oh!

Uh oh!

f750gs Mar 19, 2026 Author

f750gs
Mar 18, 2026

f750gs
Mar 19, 2026
Author