Notable changes to boot loader

Review the most notable changes to boot loader between RHEL 9 and RHEL 10.

Secure Boot shim signing requirements

Red Hat Enterprise Linux uses the shim boot loader as the first component in the UEFI Secure Boot chain. The shim binary must be signed with keys that the platform firmware trusts, and shim must trust the keys that sign later boot components such as grub2 and the kernel.

In RHEL 10.2, the shim binaries are signed with three keys, in this order:

  1. Microsoft Windows UEFI Driver Publisher (2011)
  2. Microsoft UEFI CA 2023
  3. Red Hat UEFI Publisher 2024

For a shim binary to load under Secure Boot, at least one of the corresponding certificates must be enrolled in the system firmware trust store. Earlier shim builds were signed only with the Microsoft Windows UEFI Driver Publisher (2011) key.

For more information about these signatures and their impact on Red Hat Enterprise Linux Secure Boot, see the Secure Boot Certificate Changes in 2026: Guidance for Red Hat Enterprise Linux Environments.

Changes in trusted keys for grub2 and the kernel

Starting with RHEL 10.1, the grub2 and kernel binaries are signed with longer, more secure keys. To load these components, shim must trust both Red Hat Certificate Authority (CA) 5 and CA 8. As a result, systems that upgrade to RHEL 10.2 must have a sufficiently recent shim in the existing installation before attempting the upgrade.

The minimum supported shim levels for upgrade are:

  • From RHEL 8: Update to RHEL 8.10 and ensure that shim-15.8-6 or later is installed before upgrading to RHEL 10.x.
  • From RHEL 9: Ensure that shim-15.8-3 or later is installed before upgrading to RHEL 10.x. You cannot upgrade from RHEL 9.0 directly; you must be on RHEL 9.2 or later before moving to RHEL 10.x.

If the existing RHEL 8 or RHEL 9 deployments use older shim builds that do not trust both CA 5 and CA 8, shim cannot verify the newer grub2 and kernel signatures. In such cases, systems with Secure Boot enabled will fail to start the updated boot chain.

Planning for June 2026 Microsoft certificate changes

Microsoft will no longer use the current Secure Boot signing key after June 2026. However, shim binaries that are signed only with the Microsoft Windows UEFI Driver Publisher (2011) key continue to boot after June 2026, provided that the corresponding 2011 certificate remains enrolled in firmware. The RHEL 10.2 shim binaries are also signed with the Microsoft UEFI CA 2023 certificate and the Red Hat UEFI Publisher 2024 key, which enables them to work with updated Secure Boot trust configurations.

When planning upgrades to RHEL 10.2 on systems with Secure Boot enabled, perform all of the following actions:

  • Verify that the firmware enrolls at least one of the following certificates:
    • Microsoft Windows UEFI Driver Publisher (2011)
    • Microsoft UEFI CA 2023
    • Red Hat UEFI Publisher 2024
  • Ensure that the installed shim packages on existing RHEL 8 and RHEL 9 systems meet the minimum version requirements so that shim trusts both Red Hat CA 5 and CA 8 and can load grub2 and the kernel binaries signed with longer, more secure keys.
  • Review any custom boot flows that bypass the standard shim binary and update them to comply with the RHEL Secure Boot trust model.

Failure to meet these conditions might cause RHEL 10.2 systems to fail to boot under Secure Boot and might require firmware configuration changes or rework of the Secure Boot chain of trust before deployment.

Secure Boot shim signing for RHEL 10 on x86_64 and aarch64
Red Hat Enterprise Linux (RHEL) 10 requires a signed shim binary to support Secure Boot on x86_64 and aarch64 architectures. The shim functions as the initial boot loader, verifying and loading subsequent boot components if you enabled Secure Boot. If a signed and trusted shim is not available, RHEL 10 cannot boot on systems with Secure Boot enforced. This limitation might affect deployments in enterprise and cloud environments.