Your Secure Boot Keys Expired in June - Here's How to Check

Check if Secure Boot is Even Enabled

Run this command to see whether Secure Boot is enabled, disabled, or not supported:

mokutil --sb-state

If it's not enabled, you can stop reading.

See What's in Your Firmware db

The db key database is what your firmware uses to validate everything that boots before the OS. To list the signatures currently enrolled:

mokutil --db

You'll see the Microsoft KEK and other keys. The shim loader (what loads GRUB on most Linux systems) was signed by a key that expired June 2026.

Why Machines Still Boot

The keys are still in firmware. The firmware doesn't check expiry dates - it just looks for a matching signature. So nothing broke. But if you ever need to re-enroll keys or enroll new ones, you want to be working with current material.

Update Your Keys If Needed

On Fedora and other EL-based systems:

sudo fwupdmgr update

This pulls updated keys from the LVFS firmware database. On Ubuntu, check your shim-signed package is current:

apt list --upgradable | grep shim

The Practical Takeaway

This isn't an emergency. It's housekeeping. If you manage a fleet of Linux workstations or servers with Secure Boot, worth adding a check to your provisioning scripts. The command is fast, and the output is clear:

mokutil --sb-state
echo "exit code: $?"

Set it to alert if Secure Boot state doesn't match your expected baseline. No dramatic warnings here. Just check, update if needed, move on.