Secure Boot Certificate in QEMU Ubuntu 24.04 for Windows Guest
https://askubuntu.com/questions/1566505/secure-boot-certificate-in-qemu-ubuntu-24-04-for-windows-guest
I have a computer running Ubuntu 24.04 LTS desktop where I have QEMU/KVM running. One of the guest OS is Windows 11. This VM has secure-boot on as required by Windows. The secure boot certificates originally issued in 2011 will expire next month. The new certificates were issued in 2023.
It looks like my VM is not using the new certificates. When I check the secure boot status from within Windows guest, it says:
Secure boot is on, but your device is using an older boot trust configuration that should be updated. There is not yet enough data to classify your device for automatic update.
The XML tab of the Overview section of the Virtual Machine Manager shows in part:
<loader readonly="yes" secure="yes" type="pflash">/usr/share/OVMF/OVMF_CODE_4M.ms.fd</loader>
<nvram template="/usr/share/OVMF/OVMF_VARS_4M.ms.fd">/var/lib/libvirt/qemu/nvram/win11_VARS.fd</nvram>
The files OVMF_CODE_4M.ms.fd and OVMF_VARS_4M.ms.fd have the modified date of December 10, 2025. The file OVMF_CODE_4M.ms.fd is linked to OVMF_CODE_4M.secboot.fd in the folder /usr/share/OVMF/.
I looked at the OMVF UEFI configuration menu and couldn’t find anything regarding the secure boot certificates or anyway to add new ones.
My searches have led to some solutions for Red Hat, and Proxmox, but nothing specific to Ubuntu.
Here is the Windows 11 System log:
Log Name: System
Source: Microsoft-Windows-TPM-WMI
Date: 5/6/2026 2:37:16 PM
Event ID: 1801
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: Dev1-Win11
Description:
Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware.
Review the published guidance to complete the update and maintain full protection.
This device signature information is included here.
DeviceAttributes:
BaseBoardManufacturer:;
FirmwareManufacturer:Ubuntu distribution of EDK II;
FirmwareVersion:2024.02-2ubuntu0.8;
OEMModelNumber:Ubuntu 24.04 PC (Q35 + ICH9, 2009);OEMModelBaseBoard:;
OEMModelSystemFamily:;OEMManufacturerName:QEMU;OEMModelSKU:;OSArchitecture:amd64;
BucketId: 2a0656131aa2862c533c820200125d8c3c845a85144dde851c754bc22261465a
BucketConfidenceLevel: No Data Observed - Action Required
UpdateType:
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018
Q: How do I make sure that the OMVF is using the secure boot certificates from 2023?
Update:
Thanks to Andrei's post in Stack Exchange I booted the VM from the Ubuntu 24.04 ISO in the Try Ubuntu mode and used the following commands:
mokutil --db > before
grep Subject: before
mokutil --kek | grep Subject:
sudo apt update
sudo apt install curl efivar
curl -LO https://github.com/microsoft/secureboot_objects/raw/refs/heads/main/PostSignedObjects/Optional/DB/amd64/DBUpdate2024.bin
sudo efivar -n d719b2cb-3d3a-4596-a3bc-dad00e67656f-db -f ./DBUpdate2024.bin -a -A 0x27
mokutil --db > after
grep Subject: after
Output
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011
Subject: C=US, O=Microsoft Corporation, CN=Windows UEFI CA 2023
On booting back to Windows, I asked for the Bitlocker recovery passphrase.
Now in Windows powershell commands I get one "True" and two "False":
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).bytes) -match ‘Microsoft Corporation KEK 2K CA 2023’)
False
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)
True
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Microsoft option rom UEFI CA 2023’)
False
New Question
Do I need to update these remaining two certificates? If so how?
Thanks
