{"id":2667,"date":"2026-02-28T17:30:25","date_gmt":"2026-03-01T00:30:25","guid":{"rendered":"https:\/\/www.matthewschacherbauer.com\/wp\/?p=2667"},"modified":"2026-04-10T14:14:33","modified_gmt":"2026-04-10T21:14:33","slug":"preparing-vmware-vms-for-the-2026-microsoft-secure-boot-certificate-expiration","status":"publish","type":"post","link":"https:\/\/www.matthewschacherbauer.com\/wp\/2026\/02\/preparing-vmware-vms-for-the-2026-microsoft-secure-boot-certificate-expiration\/","title":{"rendered":"Preparing VMware VMs for the 2026 Microsoft Secure Boot Certificate Expiration"},"content":{"rendered":"

This is a continuation of January’s post about the upcoming secure boot certificate expiration<\/a>. I’ve put together a script assisted strategy for patching our fleet of VMware vSphere machines by clearing out the NVRAM files in mass.<\/p>\n

The first pass on the script has been uploaded to my GitHub as VMW_MSUEFICA2023Patch.ps1<\/a> and has so far been successful in test and pre-production scenarios to work through and patch a batch of VMs.<\/p>\n

To reiterate on the issue at hand. In June of this year, the Microsoft signing certificates that are part of the secure boot process that have been in place since 2011 are expiring. Replacement of those certificates in the virtual environment cannot be handled from within the operating system because of an invalid platform key in the VMware vSphere virtual BIOS. So far, Broadcom has published two potential solutions. Either, (1) deleting the NVRAM file and allowing the UEFI variables to reset to new defaults on boot or, (2) fixing the invalid platform key through some very manual console work. I’ve opted to implement the first option.<\/p>\n

<\/p>\n

Graceful, orderly, and approved reboot cycles in an enterprise environment across thousands of virtual machines being what they are, I put together this script to at least handle most of the tedious legwork.<\/p>\n

\"\"<\/p>\n

Notice!
\nBroadcom has revoked the public guidance for the removal of the NVRAM file as a mitigation to the issue. This article makes use of that original guidance.\u00a0<\/strong>Refer to the reverting instructions at the end if the change needs to be undone.<\/p>\n

Requirements<\/strong><\/p>\n