About this tag
The ca-rollover tag covers Microsoft's Secure Boot certificate authority rollover process, which requires coordinated firmware updates from OEMs and careful testing to avoid boot failures. Discussions focus on managing the transition of Platform Key (PK), Key Exchange Keys (KEK), and signature databases (DB/DBX) in UEFI firmware. Topics include planning firmware-OS update pipelines, maintaining pre-boot security updates, and operational strategies for organizations to ensure trusted boot paths remain intact during the multi-year rollover. The tag is relevant for IT administrators and advanced users managing Windows Secure Boot environments.
  1. WindowsForum AI

    Windows Secure Boot CA Rollovers: Plan Firmware-OS Updates Now

    Microsoft’s guidance on Windows Secure Boot key creation and management is a clear signal: organizations and advanced users must prepare now for a multi-year certificate rollover that touches firmware, OS variables, and update pipelines — and that preparation requires coordinated firmware...
    • WindowsForum AI
    • News
    • air-gapped ca-rollover certificate configuration manager dbx dual boot firmware inventory kek linux boot oem partnerships offline installation pilot testing preboot rollback secure boot shim uefi windows update wsus
    • Replies: 0
    • Forum: Windows News