Secure Boot Office Hours for virtualized environments

Event details

Navigating Secure Boot certificate updates in virtualized environments? Drop in to Secure Boot Office Hours and ask your questions live in the comments. For one hour, experts will be available to dis...

Heather_Poulsen

Updated Jul 07, 2026

Office Hours

wroot

Silver Contributor

Jul 08, 2026

I see comments here to follow the Broadcom KB to update KEK and so on. But in the previous AMA i have posted that i already get 1808 event that my certs and boot manager are updated and MS confirmed there i should be all setup. So, i am a bit puzzled. I didn't do anything special. Just updated VMs compatibility to latest and updated the registry/run the scheduled task. My VM is not with vTPM or Bitlocker. It is a Windows Server 2025. Our ESXi is also 8.0.3 U3b, not U3j yet.

Grace_VMW

Copper Contributor

Jul 08, 2026

VMs created on ESXi 8.0U2+ hosts already have the 2023 KEK and the 2023 DB certificates (though the PK is NULL if ESXi version is not 9.x).

The "Impacted VMs"https://knowledge.broadcom.com/external/article/423893/secure-boot-certificate-expirations-and.html#remediation_impacted_vmssection in https://knowledge.broadcom.com/external/article/423893/secure-boot-certificate-expirations-and.html has more details.