STACKIT Server - Microsoft 2011 UEFI Root CA certificate expires on 24 June 2026
Abschnitt betitelt „STACKIT Server - Microsoft 2011 UEFI Root CA certificate expires on 24 June 2026“On 24 June 2026 the Microsoft 2011 UEFI Root CA Certificate is reaching its end date. In order to operate VMs with enabled Secure Boot it is essential that a valid certificate is present. To ensure that the new certificate is present on existing VM you need to check the EFI cert store of the VM.
For Windows VMs this is possible with the Following PowerShell snippet:
Install-Module -Name UEFIv2(Get-UEFISecureBootCerts db).signatureFor Linux VMs:
mokutil --sb-state # check SecureBoot Statemokutil --db | grep -i microsoft # Search for Microsoft Certs in EFI storeIf the Windows UEFI CA 2023 is present on the System there is no further action neccessary. If the VM has enabled Secure Boot and there is only the Microsoft UEFI Cert from 2011 in place you need to take action to receive the new certificate. To get the new UEFI Root certificate the VM has to go though a short downtime though deallocation. To Deallocate a VM with STACKIT CLI:
stackit server deallocate <serverID>After successfull deallocation the server can be startet up again. Upon startup the new Certificate is automatically added. You can verify the presence by running the previous commands.
If you have any questions, feel free to contact us by support ticket.