snowflake-01 is missing the 2023 UEFI CA cert
UEFI boots the shim which boots grub which boots the kernel. The shim is signed by a key certified by a root from 2011 which expires June 27 2026. A newer root has been available since 2023 but snowflake-01 does not have that installed.
UEFI should not refuse to boot something that is signed with an expired root so that's not the issue. But if a new shim would be installed that is not signed by the 2011 root, the system would not boot. It seems like Debian will be shipping a shim which is signed by both the 2011 and the 2023 roots. https://wiki.debian.org/SecureBoot/CAChanges has more.
The lack of a valid root might affect the way changes to the various keys used by UEFI (and the shim) are done.
We should install the 2023 root.
root@snowflake-01:~# mokutil --sb-state
SecureBoot enabled
root@snowflake-01:~# mokutil --db --short
46def63b5c Microsoft Corporation UEFI CA 2011
580a6f4cc4 Microsoft Windows Production PCA 2011
5523ff59b6 SUPERMICRO Product CA 2018
02faf3e291 AddTrust External CA Root
root@snowflake-01:~#root@snowflake-01:~# sbverify --list /boot/efi/EFI/debian/shimx64.efi
warning: data remaining[831016 vs 957136]: gaps between PE/COFF sections?
signature 1
image signature issuers:
- /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
image signature certificates:
- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows UEFI Driver Publisher
issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation Third Party Marketplace Rootcc @dcf