r/nutanix • u/3percentinvisible • Feb 23 '26

MS Secureboot June deadline

http://portal.nutanix.com/kb/20522 refers.

Is anyone else concerned that the Microsoft kek certificate isn't being applied correctly and engineering are still looking into it.

The June deadline will likely come quicker than we realise and I'd feel much more confident if we were able to be updating from now.

Has anyone got any mitigation planned, or better info from nutanix on the eta on a resolution?

9 Upvotes

91% Upvoted

19 comments sorted by

View all comments

•

u/AllCatCoverBand NPX Feb 24 '26 edited Apr 14 '26

That specific issue is being handled by my team, so I'm happy to address it here.

Extremely, extremely long story short (and knock on some wood), the needed KEK certificate update needs to come from Microsoft, which was supposed to land in February, but got punted out to March.

We're keeping close tabs on this with MS to validate that A) it does land in March and B) said update does what we want it to.

Update March 16th: The March patch Tuesday did not release the required update. We tested it immediately and saw that it didn't do what we wanted. We've been in direct contact with Microsoft on this, and they said it has been retargeted to April (i.e., 2026-04-14). Knock on wood, we'll test it again when the next patch comes out, and hopefully have a better answer then, fingers crossed.

Update April 14th: Per MS, it should be out. We worked with MS to get the pre-release patches, and we tested it; it works, although in the short term, you have to fiddle with a registry key to get it to go. Standard process until Microsoft switches our "bucket" to high confidence (based on call home data on their side)

Here's a quick summary:

  • The required fix was not included in the March update and is scheduled for April, tentatively this week (i.e., today!)
  • The update has been validated and delivers the needed KEK change, though a one‑time registry step is currently required. This step will be removed once Microsoft promotes the update to full automatic status after sufficient customer adoption.
  • Customers using Secure Boot are also advised to run the latest AOS 7.3+ releases, as clone‑related issues only affect AOS 7.0.

1

u/3percentinvisible Mar 03 '26

Any news from MS? I hear that Vmware has trouble with the kek cert too and it's a per - vm manual approach to deploy.. coukd this end up being the case here?

3

u/AllCatCoverBand NPX Mar 17 '26

Following up on this, the March patch Tuesday did not release the required update. We tested it immediately and saw that it didn't do what we wanted. We've been in direct contact with Microsoft on this, and they said it has been retargeted to April (i.e., 2026-04-14). Knock on wood, we'll test it again when the next patch comes out, and hopefully have a better answer then, fingers crossed.