skills.rest
air-gapped
air-gappedOFFICIAL
Explore all skills by this author →
GitHub

secure-boot-cert-rotation

Identify and remediate Secure Boot certificate expiries across Dell iDRAC, Linux hosts, and Harvester/KubeVirt VMs.

5|1|Updated Apr 19, 2026
Search Tags:#db#certificates#UEFI#secure-boot#KEK#Dell#Harvester
One-click install
npx skills add https://github.com/air-gapped/skills --skill secure-boot-cert-rotation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secure-boot-cert-rotation
Source: https://github.com/air-gapped/skills/tree/main/.claude/skills/secure-boot-cert-rotation
Command: npx skills add https://github.com/air-gapped/skills --skill secure-boot-cert-rotation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Triage and remediate the Microsoft Secure Boot 2011→2023 certificate rotation across Dell PowerEdge iDRAC9 bare metal, Ubuntu/Linux servers, and Harvester HCI / KubeVirt guest VMs. It highlights the trust chain, explains why firmware expiry does not immediately brick systems, and provides per-surface fix paths to restore 2023 certs.

Core Features & Use Cases

  • Surface routing: identify whether the machine uses Dell PowerEdge host firmware, generic Linux host firmware, or Harvester VM OVMF varstore, and apply the correct runbook.
  • PK/KEK/db remediation: implement the 2023 certs with a firmware-first path (Dell iDRAC), OS-side db enrollment, or offline VM varstore updates, followed by audit verification.
  • Verification and safety: validate that the 2023 certificates are present and that fleet upgrade sequencing is safe before rolling out.

Quick Start

Audit devices to identify the firmware surface and apply the appropriate 2023 cert rotation runbook to ensure boot integrity.

Frequently Asked Questions about secure-boot-cert-rotation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I rotate Secure Boot certificates to the 2023 db update on Dell PowerEdge servers?▼

Rotate Secure Boot certificates on Dell PowerEdge by applying the firmware-first path through iDRAC9 to update the PK, KEK, and db trust chain, ensuring the 2023 certs are enrolled and bootability is sustained without disruption.

Why does an expired Secure Boot KEK certificate not immediately brick my Linux host?▼

An expired Secure Boot KEK certificate does not immediately brick a Linux host because firmware expiry alone disrupts boot only when strict revocation enforcement activates, allowing a remediation window to apply 2023 db updates.

What is the best way to update Secure Boot certificates on Harvester HCI KubeVirt VMs?▼

Update Secure Boot certificates on Harvester HCI KubeVirt VMs by applying offline VM varstore updates to the OVMF firmware, remediating the PK, KEK, and db trust chain to ensure the 2023 certs are present and guest boot integrity is maintained.

Can I apply the Secure Boot 2023 certificate rotation runbook across different hardware surfaces?▼

Yes, the Secure Boot 2023 certificate rotation runbook routes across Dell iDRAC host firmware, generic Linux host firmware, and Harvester VM OVMF varstore, applying surface-specific fixes and verifying enrollment with audit commands.

How do I verify the Secure Boot PK to KEK to db trust chain after applying 2023 certificate updates?▼

Verify the Secure Boot PK to KEK to db trust chain after applying 2023 certificate updates by running platform tools and audit commands to confirm the new certificates are present and fleet upgrade sequencing is safe before rollout.

Related Skills

Explore More Software Engineering Skills→
BrownFineSecurityBrownFineSecurity
811

chipsec

Analyze offline UEFI firmware dumps to detect malware and vulnerabilities.

Official
Advanced
air-gappedair-gapped
5

harvester-upgrade

Plan and execute serial Harvester upgrades from 1.5.x to 1.8.x.

Official
Advanced
pluginagentmarketplacepluginagentmarketplace
3

devops

Automate Linux DevOps workflows for CI/CD, configuration, and deployment.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-bootkit-and-rootkit-samples

Analyze bootkit and rootkit samples across MBR, VBR, and UEFI firmware.

Community
Advanced