First came the horror news for many companies and private users relying on Windows: Support for Windows 10 ends in October 2025. Well, for companies, support will continue against a “financial settlement,” but private users are looking into the abyss. They will then have to switch to Windows 11 or buy a new PC, provided it is financially feasible. Those who stay with Windows 10 risk an insecure system, which in today’s times is very lucrative for a certain clientele of hackers.
Some private users have therefore already switched to Linux because their hardware is not made for Windows 11. My wife’s laptop is also affected by this, but nothing will be changed on it currently.
Secure Boot Certificates Expire Mid-2026
And now the next horror news: The Secure Boot certificates expire in mid-2026. Some may ask themselves: Secure Boot? What is that actually?
What is Secure Boot Anyway
Secure Boot is a security feature that is part of modern UEFI firmware in computers. It ensures that only trusted and manufacturer-approved software, such as the bootloader and the operating system, are loaded when the PC starts up. For this purpose, Secure Boot checks digital signatures of important startup programs to ensure they have not been tampered with or replaced by malware such as rootkits. This prevents malicious software from becoming active during system boot-up and causing greater damage. This makes the computer more secure and protects against attacks that occur before the operating system starts. Secure Boot is today enabled by default on many devices and is also necessary to use modern Windows versions like Windows 11.
Why Can Linux Be Affected?
Better Support for Modern Hardware:
UEFI replaces the old BIOS and supports functions such as booting hard drives over 2 TB thanks to GPT partitioning. Linux can thus utilize larger and more flexible partitions.Secure System Boot with Secure Boot:
UEFI enables Secure Boot, thereby protecting Linux systems from manipulated or malicious boot programs. Many distributions like Fedora, Ubuntu, or Debian support Secure Boot.Easier Multi-Boot Management:
With UEFI, multiple bootloaders can be stored in the EFI system partition and selected. This facilitates dual-boot setups with Windows and multiple Linux systems.Faster Booting:
UEFI starts faster than classic BIOS, which particularly benefits Linux on modern hardware.System Control and Firmware Access:
Via systemd commands, one can start and configure the UEFI setup directly from within Linux, which was not possible with the old BIOS.
So UEFI can also be useful for Linux. Not so much for older hardware, but yes for newer hardware.
Why Do the Certificates Have to Be Renewed Anyway?
Well, every certificate has a certain validity period. That period eventually runs out. Certificates are known from websites. But also with hardware. In the case of Secure Boot, the certificates are valid for 15 years. The 15 years run out in 2026. Therefore, new ones must be put on the computer.
What Should I Do Now?
Well, first do nothing. Or better said, ask the computer manufacturer if there is already an update available. If a BIOS update is available, one should look at the changes to see if current certificates are already included.
Installing the BIOS update itself is not exactly something one can compare with refueling a passenger car or truck. If it goes wrong, the computer is usually destined for the trash bin. Correcting this is possible but will be expensive.
“Important: Before the BIOS update, all important data should be backed up and the device must absolutely be supplied with power during the update and not switched off. After the update, you may have to enter BitLocker recovery keys, for example, for encrypted drives.”
This means that the update should be done by someone who knows what they are doing. This is not a hundred percent guarantee, but an expert is more likely to notice if something goes wrong or not.
With older hardware, I would consider in the private sector whether I really need Windows. For many things there are already good alternatives.
