Secure Boot certificate updates for Linux on Azure virtual machines (original) (raw)

Applies To

Virtual Machine running Linux

Original publish date: June 12, 2026

KB ID: 5103014

In this article

Introduction

Secure Boot is a UEFI firmware security feature that helps ensure that only trusted, digitally signed software runs during the VM boot sequence. Microsoft Secure Boot certificates issued in 2011 begin expiring in June 2026.

To maintain Secure Boot protection and continued servicing of the early boot process, Azure Trusted Launch running Linux must be updated with Secure Boot 2023 db and KEK certificates in virtual UEFI firmware. Confidential Virtual Machines for Linux on Azure with old certificates must be recreated.

If a VM continues to rely on the 2011 certificates after expiration, it will continue to boot. However, it will no longer receive new security protections in the form of shim updates and future certificates and revocations.

Identify scenarios that require action

Review the following scenarios to determine whether action is required:

Trusted Launch and Confidential Virtual Machines created after April 2024 typically already include Secure Boot 2023 certificates in virtual UEFI firmware.

Note: Linux Confidential VMs created prior to April 2024 should not be manually updated since the Confidential Disk Encryption relies on PCR7 value of the vTPM which is calculated based on the secure boot variables. Updating the secure boot certificates without ensuring FDE key re-sealing will cause the confidential VM to go in recovery mode. It is recommended to recreate such old confidential VMs to get the new certificates.

Azure guest VM considerations

Secure Boot updates for Linux on Azure VMs involve two components:

Update operations are initiated from within the guest operating system and rely on platform support to apply authenticated updates to Secure Boot variables.

After identifying applicable scenarios, inventory your environment to determine which VMs require updates.

Actions required

For all Azure guest VMs:

For Trusted Launch VMs:

For Confidential VMs:

Deploy updates

Secure Boot certificate updates for Linux on Azure VMs are initiated from within the guest operating system. These updates differ by distro vendors, and customers should check with their distro vendor first on the recommended method.

Recommendations from Linux OS vendors:

Recommendations by Azure for Confidential VMs:

Firmware update methods

Note: Before trying the UEFI variable updates directly on production VMs, customers can utilize the Azure quick start template to simulate the Linux Trusted Launch VM with older 2011 UEFI CA certificates.

Using fwupd

Ensure that the VM has fwupd version 2.0.8 or later installed.

To update both KEK and db, run these commands with fwupdmgr:

sudo fwupdmgr refresh

sudo fwupdmgr update

Using efitools

Download db and KEK update packages for Azure.

Use efi-updatevar to install the update packages

sudo efi-updatevar -a -f DBUpdate3P2023.bin db

sudo efi-updatevar -a -f KEKUpdate_Microsoft_PK1.bin KEK

sudo reboot

Using sbsigntools

Download db and KEK update packages for Azure.

wget https://github.com/microsoft/secureboot\_objects/raw/refs/heads/main/ \

PostSignedObjects/Optional/DB/amd64/DBUpdate3P2023.bin

wget https://github.com/microsoft/secureboot\_objects/raw/refs/heads/main/ \

PostSignedObjects/KEK/Microsoft/KEKUpdate_Microsoft_PK1.bin

Use sbkeysync utility of sbsigntools to install the update packages:

sudo mkdir -p /etc/secureboot/keys/db

sudo cp DBUpdate3P2023.bin /etc/secureboot/keys/db

sudo mkdir -p /etc/secureboot/keys/KEK

sudo cp KEKUpdate_Microsoft_PK1.bin /etc/secureboot/keys/KEK

sudo chattr -i /sys/firmware/efi/efivars/db-*

sudo chattr -i /sys/firmware/efi/efivars/KEK-*

sudo sbkeysync --verbose

sudo chattr +i /sys/firmware/efi/efivars/db-*

sudo chattr +i /sys/firmware/efi/efivars/KEK-*

sudo reboot

Verification methods

Using mokutil

Using efitools

Linux boot chain update

After the successful firmware update, it is safe to apply shim updates from the Linux distribution vendors.

Other Azure resources considerations

Azure resource Created before April 2024 Action required for TVM Action required for CVM
Backup/snapshot Yes Boot VM, apply updates, recapture Recreate the CVM, recapture
Backup/snapshot No No action needed No action needed
Compute Gallery image Yes Deploy, update, recapture Recreate the CVM, recapture
Compute Gallery image No No action needed No action needed

Monitor update status

Verify updates through the guest OS:

Monitoring and validation approaches may vary by Linux distribution, and you should check with your distribution vendor.

Mitigation steps in case of boot failures

In case of a failure scenario such as boot failure after UEFI variable update, you can reset the UEFI settings using one of the below methods:

  1. Restore the backup taken before starting the manual update process.
  2. Convert Trusted Launch VM to Standard VM and re-apply Trusted Launch security type on the VM. (More details here: Enable Trusted launch on existing Gen2 VMs - Azure Virtual Machines | Microsoft Learn)
  3. Export the OS vhd to a storage account, create a gallery image from the vhd and deploy the VM using gallery image version.

​​​​​​​​​​​​​​Third-party information disclaimer

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. We make no warranty, implied or otherwise, about the performance or reliability of these products.

We provide third-party contact information to help you find technical support. This contact information may change without notice. We do not guarantee the accuracy of this third-party contact information.

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.