The Microsoft UEFI CA 2011 certificate expired on June 27, 2026, marking the completion of the UEFI CA rollover. Thanks to coordinated efforts, 21 shim binaries were dual-signed with both old and new CAs before the deadline, with Microsoft turning around some submissions in under a day. Debian already has a new dual-signed shim in unstable/testing, with updates for Debian 12 (bookworm) and 13 (trixie) coming in the next point releases alongside fwupd upgrades. Users are urged to update their systems to avoid future boot failures.
544 Impressions