Secure Boot Certificate in QEMU Ubuntu 24.04 for Windows Guest
https://askubuntu.com/questions/1566505/secure-boot-certificate-in-qemu-ubuntu-24-04-for-windows-guest
I have a computer running Ubuntu 24.04 LTS desktop where I have QEMU/KVM running. One of the guest OS is Windows 11. This VM has secure-boot on as required by Windows. The secure boot certificates originally issued in 2011 will expire next month. The new certificates were issued in 2023.
The above page shows a table of expiring certificates:
| **Expiring Certificate** | **Expiration date** | **New Certificate** | **Storing location** | **Purpose** |
| ----------------------------------------- | ------------------- | ------------------------------------ | -------------------- | ---------------------------------------------------- |
| **Microsoft Corporation KEK CA 2011** | June 2026 | Microsoft Corporation KEK 2K CA 2023 | Stored in KEK | Signs updates to DB and DBX. |
| **Microsoft Windows Production PCA 2011** | Oct 2026 | Windows UEFI CA 2023 | Stored in DB | Used for signing the Windows boot loader. |
| **Microsoft UEFI CA 2011\*** | June 2026 | Microsoft UEFI CA 2023 | Stored in DB | Signs third-party boot loaders and EFI applications. |
| **Microsoft UEFI CA 2011\*** | June 2026 | Microsoft Option ROM UEFI CA 2023 | Stored in DB | Signs third-party option ROMs |
It looks like my VM is not using the new certificates. When I check the secure boot status from within Windows guest, it says:
Secure boot is on, but your device is using an older boot trust configuration that should be updated. There is not yet enough data to classify your device for automatic update.
This page says if I see this message then:
Your device might need additional validation before the update can proceed automatically. Visit aka.ms/getsecureboot for more information.
The link takes me back to the original page linked above.
This made me think Windows update failed to work with QEMU's UEFI firmware called OVMF.
The XML tab of the Overview section of the Virtual Machine Manager shows in part:
<loader readonly="yes" secure="yes" type="pflash">/usr/share/OVMF/OVMF_CODE_4M.ms.fd</loader>
<nvram template="/usr/share/OVMF/OVMF_VARS_4M.ms.fd">/var/lib/libvirt/qemu/nvram/win11_VARS.fd</nvram>
The files OVMF_CODE_4M.ms.fd and OVMF_VARS_4M.ms.fd have the modified date of December 10, 2025. The file OVMF_CODE_4M.ms.fd is linked to OVMF_CODE_4M.secboot.fd in the folder /usr/share/OVMF/.
I looked at the OMVF UEFI configuration menu and couldn’t find anything regarding the secure boot certificates or anyway to add new ones.
Here is the Windows 11 System log:
Log Name: System
Source: Microsoft-Windows-TPM-WMI
Date: 5/6/2026 2:37:16 PM
Event ID: 1801
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: Dev1-Win11
Description:
Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware.
Review the published guidance to complete the update and maintain full protection.
This device signature information is included here.
DeviceAttributes:
BaseBoardManufacturer:;
FirmwareManufacturer:Ubuntu distribution of EDK II;
FirmwareVersion:2024.02-2ubuntu0.8;
OEMModelNumber:Ubuntu 24.04 PC (Q35 + ICH9, 2009);OEMModelBaseBoard:;
OEMModelSystemFamily:;OEMManufacturerName:QEMU;OEMModelSKU:;OSArchitecture:amd64;
BucketId: 2a0656131aa2862c533c820200125d8c3c845a85144dde851c754bc22261465a
BucketConfidenceLevel: No Data Observed - Action Required
UpdateType:
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018
My searches have led to some solutions for Red Hat, and Proxmox, but nothing specific to Ubuntu.
From the Linux perspective most solutions refer only to updating to the Microsoft UEFI CA 2023 certificate. I have not seen anything on how or if one should update the three other certificates expiring in 2026 when running Windows in a VM.
Q: How do I make sure that the OMVF is using all the secure boot certificates from 2023 so that Windows 11 works as expected beyond June 2023?
Thanks
