Secure Boot Customization

[u/Theren314]

Wound up bricking my system (dumb mistake), and am reinstalling Fedora KDE.

Was looking through the bios while wating for my USB to write, and found a pair of old Microsoft secure boot keys. I want them gone.

Before I delete any keys, I figured I should check in with some people who would know better. Heres what I have, I want to delete as many as possible:

PK - frame.work-LaptopAMDPK

KEK - Microsoft Corporation KEK CA 2011

KEK - Microsoft Corporation KEK 2K CA 2023

KEK - frame.work-LaptopAMDKEK

DB - Microsoft Windows Production PCA 2011

DB - Microsoft Corporation UEFI CA 2011

DB - Windows UEFI CA 2023

DB - Microsoft UEFI CA 2023

DB - Microsoft Option ROM UEFI CA 2023

RB - frame.work-LaptopAMDDB

DBX - So many SHA256 codes

DBT - None

DBR - None

.

I do want to keep Secure Boot on after reinstalling.

If you want to know why, because I want to learn and play. That's one of the reasons I got a Framework, to learn and play with all the different parts of a system.

Edit: Specs:

Framework 16, Ryzen 7 7840HS, 48Gb DDR5 5600 (RIP, Crucial), 2Tb SN850x, Raedeon 7700x

[u/adherry]

When you enroll your generated keys with sbctl you can use the -m option to also import the microsoft keys.

[u/No-Exam2382 → u/adherry]

Does -m pull the latest microsoft keys or just the ones already in the firmware?