Microsoft UEFI CA rotation: What it means for Ubuntu users and vendors
Microsoft’s 2011 UEFI and KEK CAs are set to expire in June 2026 and are being replaced by 2023 CAs. While existing boot assets will continue to work, future shim bootloader updates from Canonical will use the new 2023 CA. Failure to update the CA on existing Ubuntu installations (26.04 LTS and earlier) will lead to package management failures and an inability to install security and non-security updates starting in Q4 2026 or later. Canonical is distributing the 2023 CA through fwupd (version >=...




