Please refer to this article for enable and disable secure boot

https://knowledge.broadcom.com/external/article/377377/enable-or-disable-uefi-secure-boot-for-a.html

If secure boot is not enabled no need to worry on certificate expiry of KEK or DB AFAIK

The complete documentation can be found here:

• https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/9-1/vsphere-security/securing-esxi-hosts/uefi-secure-boot-for-esxi-hosts.html
• https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/9-1/vsphere-virtual-machine-administration/configuring-virtual-machine-options/configuring-virtual-machine-boot-options/enable-or-disable-uefi-secure-boot-for-a-virtual-machine.html
• https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/9-1/esx-upgrade/after-upgrading-or-migrating-hosts/enable-secure-boot-on-an-upgraded-esxi-host.html

Secure Boot is supported for VMware VMs. There is a "VM Options" tab on the VM Settings. You can select "Boot Options" and there should be a Secure Boot check box available when UEFI firmware is selected and the HW version of the machine is greater than 13.
It is usually enabled by default when a Windows is selected as the VM OS.

Secure boot is supported in VMware.  You can edit the VM configuration to enable secure boot.

please check this KB from VCF team

https://knowledge.broadcom.com/external/article/423893/secure-boot-certificate-expirations-and.html