And especially for those with one of the many, many, boards long since abandoned by their manufacturers. I wish I could get a clearer read on that, and how to handle it if you have one of the abandoned boards.
Well, if your board was made by one of the ~50 manufacturers
listed here and if you are running Windows, then you should be okay, as Microsoft
should be able to install the new KEK they need without you needing to do anything, even after their current 2011 KEK has expired (in June 2026), so that they can then install the new 2023 DB Secure Boot certificates that
will be needed to boot anything Secure Boot
that is going to be signed for Secure Boot in late 2026 (that last part being important, as the new KEKs/DBs are still
not needed to the Windows 25H2 UEFI bootloaders, so, technically, you don't actually have to care about this until Microsoft releases Windows 11 26H2).
This is what I alluded to above: If you can get in touch with the manufacturers,
and Microsoft are definitely doing that, then they should be able to sign a KEK update package for their platforms, which in turns allows OS makers like Microsoft to install said KEK (and ultimately the DB they need, which is the whole point of the KEK), "remotely", and regardless of whether everything else is expired.
So that's also why HP (who did provide a signed KEK update package to Microsoft) and most other vendors are currently saying to end users (who are not expected to be at that great a risk from BlackLotus and other vulnerabilities):
"Just wait. Microsoft should take care of the Secure Boot key updates on their own..."
And the expectation is that, for most people, this
should indeed be fine... as long as they are running Windows (not sure how Linux distro maintainers are going to address this, though the signed KEKs provided to Microsoft are not for Microsoft use only and can be used just as well by Linux distros to update KEKs and DBs for the new Secure Boot certs) and, more crucially, as long as they don't happen to go into their UEFI firmware and choose to reset their Secure Boot keys to vendor defaults, because, if you do that on pretty much every PC that was released before 2025, you're going to reset to the 2011 certs, and Secure Boot will produce a violation error with any post 26H2 signed bootloader (be them for booting Windows or Linux or anything else).
And, you should absolutely not count on manufacturers to release firmware updates, as they most certainly could, just to add the 2023 certs on anything they released more than 2 years ago...
Now, I guess the expectation of Microsoft (and others) is that, if/when that happens, the user will be smart enough to disable Secure Boot (and the irony is not lost on me that, at one stage, Microsoft were trying to champion platforms were Secure Boot could not be disabled by the user...
ever, whereas they are now going to be relying on people being able to disable Secure Boot to fix a situation where Windows can no longer boot), then boot into Windows, which
should be smart enough to look at the Secure Boot dabatases during every single boot to tell if the 2023 KEKs and DBs are missing and reinstall them automatically if that's the case (so that the user can re-enable Secure Boot on next reboot).
But of course, giving how obtuse or downright broken the Secure Boot Security Violation messages seem to be implemented (on one of the Gigabyte platform I use, you just get a weird 'OK' button, with no other text, when Secure Boot fails validation, so good luck to regular joes understanting that this is really Secure Boot complaining), 2027 and later years are likely to show that quite a few people will fall through the cracks of
"Just let the OS handle that for you..."
Interesting times ahead.
But the takeway is that,
if you can see your platform manufacturer
here, then you
should probably be okay,
eventually, without doing anything...
