If you will ever be thinking of (unlikely for many, I know, anyways) having SecureBoot enabled and use a distribution which supports it (or enable it in Arch etc.) in a future, you might want to have a read:
https://www.redhat.com/en/blog/expiration-secure-boot-signing-certificates-2026
Sharing is CARING!
YOU (yes you 
) are WelCome!
And AS always the PLEASURE was all om MY SIDE.
THANKs for your ATTENTION!
@cactux , the REAL one; The ONE and ONLY 
FWIW I ran fwupd some time ago and that appeared to update the certificates for both my systems
Same here, on two systems. I’ve got one more to go. I’ll be looking into it this evening.
Devices that have been updated successfully:
• UEFI CA (2011 → 2023)
• UEFI dbx (20241101 → 20250902)
Just did the “fwupdmgr update” on my Thinkpad T14 Gen2 AMD, but Secure Boot is bios disabled.
You can keep secure boot disabled and boot up your current system normally.
However this would effect those who use signed bootloaders (distributions like Debian, Ubuntu, Fedora, openSUSE, etc.) when their next iteration of their bootloaders need to be signed only by the 2023 key for them to be able to boot with Secure Boot enabled.
I also have Secure Boot disabled on my Thinkpad T14 Gen 1, and did the updates (BIOS & dbx keys) today.
fwupdmgr’s output told me something about I have to “Reset Factory Keys” in the BIOS, since it wouldn’t update the keys automatically. Only now I fear I might mess up any keys added/needed for EOS…
Or can I simply ignore that and—if ever—I install something requiring Secure Boot, the correct keys would be there upon enabling Secure Boot?
Otherwise, BIOS update (from 1.33 to 1.36 dated 06/02/2026) and key install went without errors.
Those dbx keys are only used by windows secure boot , and I never noticed any harm if you update or remove them (that have to be done from the Bios), but because linux doesn’t need them it is just annoying if a update message comes up using fwupdmgr.
Cheers for the info! No Windows here, so all good, I suppose.
great news, thanks. did not know they were a WIN thing. all sorts of packages I can’t identify in fwupdmgr–you got me thinking find the ones that are Win-centric and remove– but I tell myself it’s good to self-update the firmware all the same.
Well yes I get to remove those keys ,among others that give me X507 error messages (or something like that), whenever I boot my system after a Bios flash.
Secure Boot! We don’t need not stinking secure boot. 
stupid question since I never removed them: is all that firmware stuff in /boot or /files or? thanks
Technically speaking this is not firmware stuff, but “stuff” that is needed by secure boot to function, and it resides in the Bios. As far as I know they are keys generated by the manufacturer of your motherboard and they can be found around the secure boot section.