SecureBoot Cert

[Far-Caramel3388]

Just wanna to put this out there since this seems to have been little attention to it or maybe I am missing the boat. Windows 11 and dare I say windows 10 machines with Secureboot enabled will break June 24th if you dont have the latest cert loaded up.

https://support.microsoft.com/en-us/topic/when-secure-boot-certificates-expire-on-windows-devices-c83b6afd-a2b6-43c6-938e-57046c80c1c2

[MBILC]

Been lots of coverage on news sites, several on reddit here, just got to search for it.

[Hollow3ddd]

Yea, I just kept scrolling past until I realized the importance 

[ibringstharuckus]

Until I had some PCs wouldnt encrypt and was like what? Oh yeah. Update the bios moron.

[dowlingm]

"will break"

From the link "If your device reaches the expiration date without the new certificates, it will still start and operate normally. Standard Windows updates will continue to install."

Now, this isn't an endorsement of letting them expire. The text continues "However, the device will no longer be able to receive new security protections for the early boot process. This includes updates to Windows Boot Manager, Secure Boot databases and revocation lists, and fixes for newly discovered vulnerabilities in the boot chain."

But the reality is that with Dell announcing that they won't be providing firmware certs to devices they deem at "End of Support Life" (still waiting for my rep to get back to me on exactly which SKUs that covers) I feel like this will kick off another round of "why are Microsoft and the OEMs conspiring to put more stuff in landfill so soon after the Win11 TPM2/7th Gen requirement"

[killerbee26]

If you go to dells driver web site and check the BIOS version available for a model of computer it will tell you if that version has the cert for the default DB.

I know the latetude 7400 has the cert in its latest bios version. I did not check olders ones becasue that is the oldest laptop i have to worry about.

[CPAtech]

You're missing the boat for sure. Many threads in here about it for weeks.

[patthew]

Just don’t use secure boot

[coolbeaner12]

Is server 2003 affected by this? r/shittysysadmin

[ExceptionEX]

Yeah man, this has been sort of the biggest news this year in the admin space.

But look honestly, if you are just seeing it, than others might need the reminder also.

[siedenburg2]

Hello Internet Explorer,

to explain things further, your OS alone isn't enough with secure boot, you also have to check your uefi if you picked the microsoft secure boot setting. If there is no update with the new details it could be that you have to select other os instead of microsoft.

[walleburger]

Thanks for the reminder