Remove 2011 Microsoft CA keys

[Ignatius18652]

In Microsoft's page regarding Secure Boot, MS is only requiring the 2023 keys plus "Microsoft Corporation UEFI CA 2011":

https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance?view=windows-11#14-signature-databases-db-and-dbx

The "Microsoft Corporation KEK CA 2011", "Microsoft UEFI CA 2011" and "Microsoft UEFI CA 2011" will expire in June 2026, while "Microsoft Windows Production PCA 2011" expires October 2026.

These old certificates have security vulnerabilities (Golden Key, Black Lotus) and backdoors and I heard their hashes are already in the dbx rendering them useless.

I recommend removing them with the exception of "Microsoft Corporation UEFI CA 2011" to prevent device bricking and also to comply with MS requirements.

[Ignatius18652]

Update: I removed the 2011 KEK and the 2011 Windows CA and kept "Microsoft Corporation UEFI CA 2011". Everything works fine in both Windows and Linux, only that fwupd doesn't detect dbx revocations to update (I guess they're still using 2011 KEKs?).

Note that the 2011 MS UEFI CA was split into 2023 Microsoft UEFI CA and 2023 Option ROM CA. The former is for verifying 3rd party bootloaders and EFI (so basically linux distros if you don't enlist your own keys).

Can anyone confirm if it's safe to remove the 2011 UEFI CA since the 2023 UEFI CA replaces it and it will expire in June anyway and is already in the revocation lists?

My computer's BIOS updated and has the both the 2011 and 2023 keys as factory defaults now, but surprisingly doesn't come with the 2023 Option ROM CA, only the 2023 KEK, 2023 Windows CA (for windows bootloader) and the 2023 Microsoft UEFI CA. Does that mean my computer doesn't have Option ROMs, or does that mean it's using the 2011 UEFI CA for Oproms? makes no sense since it's expiring.

[Foxboron]

These old certificates have security vulnerabilities (Golden Key, Black Lotus) and backdoors and I heard their hashes are already in the dbx rendering them useless.

Please write plain issues and don't reference attack vectors which are unrelated. Neither of the two mentioned attacks are related to the key and have been mitigated years ago.

I do get questions about things people write on these issues.