Question: Should a Microsoft UEFI CA 2011-signed shim still boot on firmware that has completed Microsoft's 2023 Secure Boot certificate transition?

[dryada70749]

Description

Hi,

I'm trying to understand the expected behavior of the upstream shim project regarding Microsoft's 2023 Secure Boot certificate transition.

Hardware

• MSI Crosshair 16 Max HX E2WGXK
• BIOS: E2652IMS.507 (latest)

Operating Systems

• Windows 11
• Ubuntu 26.04 LTS Desktop Live USB (official ISO)
• Kubuntu 26.04 LTS

Both operating systems are installed in UEFI mode on separate NVMe SSDs.

Problem

With Secure Boot enabled:

• Windows 11 boots normally.
• Ubuntu 26.04 LTS Desktop Live USB (official ISO) fails before GRUB.
• Kubuntu 26.04 LTS installed on SSD fails in exactly the same way.

Firmware reports:

Secure Boot Violation

Invalid signature detected.
Check Secure Boot Policy in Setup.

With Secure Boot disabled:

• Windows boots normally.
• Ubuntu boots normally.

Verification

I have verified the following:

• Latest BIOS installed (E2652IMS.507)
• Factory Secure Boot Keys restored
• Secure Boot Standard Mode
• Windows Secure Boot works correctly
• Windows TPM Event ID 1808 confirms Microsoft's 2023 Secure Boot certificate transition completed successfully
• Windows Status tool reports Windows UEFI CA 2023 is active
• EFI Boot Entry points to EFI\ubuntu\shimx64.efi
• shimx64.efi is Microsoft signed
• grubx64.efi is Canonical signed
• Ubuntu official signed kernel
• shim-signed package version:
  1.59+15.8-0ubuntu2
• SHA256 of /boot/efi/EFI/ubuntu/shimx64.efi is identical to /usr/lib/shim/shimx64.efi.signed

sbverify reports:

shim issuer:

Microsoft Corporation UEFI CA 2011

grub issuer:

Canonical Ltd. Master Certificate Authority

Question

My understanding is that Microsoft's 2023 Secure Boot certificate transition has already completed successfully on this machine, and Windows boots normally using the 2023-signed Windows Boot Manager.

However, the current Ubuntu official shim is still signed by Microsoft UEFI CA 2011.

I noticed issue #824 discusses updating Microsoft's db/KEK/dbx to the 2023 certificates after booting with shim, which seems to imply that a Microsoft UEFI CA 2011-signed shim is still expected to boot successfully.

Therefore I would like to ask:

1. Is a Microsoft UEFI CA 2011-signed shim still expected to boot successfully on firmware that has already completed Microsoft's 2023 Secure Boot certificate transition?

2. If the answer is yes, then the behavior I'm observing would appear unexpected.

3. If the answer is no, is there an ongoing migration plan toward a 2023-signed (or dual-signed) shim for Ubuntu 26.04 LTS or future Ubuntu releases?

I'm not trying to determine whether this is an OEM firmware issue or an Ubuntu packaging issue.

I would simply like to understand the expected behavior of the upstream shim project regarding Microsoft's 2023 Secure Boot transition.

If additional information (sbverify output, mokutil output, Secure Boot database information, etc.) would be helpful, I'd be happy to provide it.

Thank you.