Expiring Microsoft Secure Boot Certificates

[b-pfl]

Describe the issue
Microsoft's secure boot certificates expire in June 2026 (https://techcommunity.microsoft.com/blog/windows-itpro-blog/act-now-secure-boot-certificates-expire-in-june-2026/4426856).

Does this affect UTM in any way?

[daniel-k-persson-te]

About this, dont know if its related. Im using UTM to test Windows Autopilot. This has been working since atleast 1 year back (when i got my Macbook Pro M3). However, now I recive TPM Attestation timout during Autopilot Enrollment status page. Anyone expericens this?
When I search the issue it seams to be related to the new Secure Boot certificates so thats why it might be related to this issue.

[osy]

New boot certificates only apply to new VMs or if you manually reset UEFI variables.

[daniel-k-persson-te]

Yes, but lets say I create a new VM. I install Windows 11 (tested with 23H2, 24H2 and 25H2), register the machine i Autopilot in OOBE using Get-WindowsAutopilotInfo, reboot and initiate the ESP. Then the VM fails on the first ESP step Securing your hardware with error 0x800705b4.

[osy]

Can you file an issue with more details?

[daniel-k-persson-te]

Yes

[daniel-k-persson-te]

Hmm, I think I messed up my testing before. To be clear, I think maybe I just run into the issue when running Windows Autopilot Pre-Provision. That is clearly not supported on VMs. As for now, I can not reproduce the issue if I install Windows 25H2 and initiate the ESP by signing in with an Entra account.