Act now: Secure Boot certificates expire in June 2026

Winuser · Jul 29, 2025

This is what I get.

bikemanAMD · Jul 29, 2025

Mine shows this

uncyler825 · Jul 29, 2025

bikemanAMD said:
Mine shows this

View attachment 140834

Winuser said:
This is what I get.
View attachment 140833

You have successfully used the new Windows Boot Manager. The Microsoft article states that the actual situation is to verify the certificate of the file.

uncyler825 · Jul 30, 2025

I improved the Check_EFIBootFile.ps1 script.

And thanks to the original author who created this script:
DESCRIPTION
Original Author: Matthew Graeber (@mattifestation)
Modified By: Jeremiah Cox (@int0x6)
Modified By: Joel Roth (@nafai)
Additional Source: A basic "dbx" UEFI variable parser to dump blacklisted UEFI bootloader hashes
Additional Source: SplitDbxContent 1.0
License: BSD 3-Clause

Added KEK certificate.
Added Try {} catch {} to DB, KEK and DBX certificate detection.
Mount the EFI partition to verify the actual Windows Boot Manager certificate.

Modified 1:

Code:

try {
$db_Certs = @((Get-SecureBootUEFI db | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
} catch {
$db_Certs = $false
}
if ( $db_Certs -eq $false) {
Print-Header 'EFI DB Certificates'
} else {
Print-Header 'EFI DB Certificates'
foreach ($Cert in $db_Certs) {
    "    {0}" -f $Cert
}
}

try {
$kek_Certs = @((Get-SecureBootUEFI kek | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
} catch {
$kek_Certs = $false
}
if ( $kek_Certs -eq $false) {
Print-Header 'EFI KEK Certificates'
} else {
Print-Header 'EFI KEK Certificates'
foreach ($Cert in $kek_Certs) {
    "    {0}" -f $Cert
}
}

try {
$dbx_Certs = @((Get-SecureBootUEFI dbx | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
} catch {
$dbx_Certs = $false
}
if ( $dbx_Certs -eq $false) {
Print-Header 'EFI DBX Certificates'
} else {
Print-Header 'EFI DBX Certificates'
foreach ($Cert in $dbx_Certs) {
    "    {0}" -f $Cert
}
}

Modified 2

Code:

Write-Host "Mount the EFI partition to label X:" -ForegroundColor Green
$command = 'mountvol X: /s'
Start-Process -FilePath "cmd.exe" -ArgumentList "/c $command" -NoNewWindow -Wait

$BootMgr_File = "X:\EFI\Microsoft\Boot\bootmgfw.efi"
$BootMgr_Cert = Get-PFXCert $BootMgr_File
Write-Host "Validate that $BootMgr_File file is signed by the $BootMgr_Cert certificate!" -ForegroundColor Green
Write-Host "Unmount X: EFI partition!" -ForegroundColor Green
$command = 'mountvol X: /d'
Start-Process -FilePath "cmd.exe" -ArgumentList "/c $command" -NoNewWindow -Wait

Code:

powershell -nop -ep bypass -f Check_EFIBootFileUpdated.ps1

garlin · Jul 30, 2025

uncyler825 said:
I improved the Check_EFIBootFile.ps1 script.

And thanks to the original author who created this script:
DESCRIPTION
Original Author: Matthew Graeber (@mattifestation)
Modified By: Jeremiah Cox (@int0x6)
Modified By: Joel Roth (@nafai)
Additional Source: A basic "dbx" UEFI variable parser to dump blacklisted UEFI bootloader hashes
Additional Source: SplitDbxContent 1.0
License: BSD 3-Clause

Added KEK certificate.

Added Try {} catch {} to DB, KEK and DBX certificate detection.

Mount the EFI partition to verify the actual Windows Boot Manager certificate.

I wrote the script, but using Matthew Graeber's PS function to decode the cert names. Every other script looks for a known string match.
Thanks.

gunrunnerjohn · Jul 30, 2025

Question: What is this certificate?

I'm presuming that since I still only have this under EFI Files, that I should wait for Windows Update to update the boot partition?

Boot Manager [Microsoft Windows Production PCA 2011] on Disk is allowed.

uncyler825 · Jul 30, 2025

gunrunnerjohn said:
Question: What is this certificate?

View attachment 140907

I'm presuming that since I still only have this under EFI Files, that I should wait for Windows Update to update the boot partition?

Boot Manager [Microsoft Windows Production PCA 2011] on Disk is allowed.

Except on systems that are locked down to boot Windows only, the OEM should consider including the Microsoft 3rd Party UEFI CAs and Microsoft Option ROM CA to allow UEFI drivers and applications from 3rd parties to run on the PC without requiring additional steps for the user.

Windows Boot Manager will be automatically updated for you in a future security update. Probably after January 2026, as Microsoft will enforce CA 2011 revocation in January 2026. Of course, you can also follow Microsoft's guide to update your Windows Boot Manager.

bikemanAMD · Jul 30, 2025

Think mine is all set as its gonna be for now

uncyler825 · Jul 30, 2025

bikemanAMD said:
Think mine is all set as its gonna be for now

You're ready, but Microsoft isn't. Because Microsoft still hasn't updated the retail version of Windows 11 ISO files.

If you have completed all mitigation steps as instructed by Microsoft, you may have already applied DBX to SVN. SVN can only be confirmed from Key Management in BIOS.

Apply the SVN update to the firmware.

The Boot Manager deployed in Step 2 has a new self-revocation feature built-in. When the Boot Manager starts to run, it performs a self-check by comparing the Secure Version Number (SVN) that is stored in the firmware, with the SVN built into the Boot Manager. If the Boot Manager SVN is lower than the SVN stored in the firmware, the Boot Manager will refuse to run. This feature prevents an attacker from rolling back the Boot Manager to an older, non-updated version.

In future updates, when a significant security issue is fixed in the Boot Manager, the SVN number will be incremented in both the Boot Manager and the update to the firmware. Both updates will be released in the same cumulative update to make sure that patched devices are protected. Each time the SVN is updated, any bootable media will need to be updated.

Starting with the July 9, 2024, updates, the SVN is being incremented in the Boot Manager and the update to the firmware.

Then all retail versions of Windows will fail to install because their SVN versions are too low. As far as I know, downloading from UUP and enabling UpdtBootFiles in ConvertConfig.ini will allow SVN verification to pass normally.

Retail version of Windows 11 ISO files, SVN 3.0 (SVN requires 7.0+)

UUP ISO 26200.5722 (UpdtBootFiles=1), SVN 7.0

SVN is optional and not mandatory for all users.

bikemanAMD · Jul 30, 2025

Oh i see, well i've never used UUP Method of obtaining Windows ISOs in the past.

Guess when 25H2 comes out i'll let Windows update install that, and hopefully that goes well, and once the new boot files are in the future ISO's, then i'll do my 25H2 clean install i suppose in that case

but yeah i did follow all the revocation steps including the SVN portion, if turns out i went too far, then too late now i guess, and will just have to work around it.

uncyler825 · Jul 30, 2025

bikemanAMD said:
Oh i see, well i've never used UUP Method of obtaining Windows ISOs in the past.

Guess when 25H2 comes out i'll let Windows update install that, and hopefully that goes well, and once the new boot files are in the future ISO's, then i'll do my 25H2 clean install i suppose in that case

but yeah i did follow all the revocation steps including the SVN portion, if turns out i went too far, then too late now i guess, and will just have to work around it.

If you are familiar with BIOS operation, you can manually delete the SVN Key from the Key Management. If you want to add SVN again, run the SVN firmware update, and then the SVN Key will be updated to DBX again.

gunrunnerjohn · Jul 30, 2025

My system was a retail install on a Gigabyte motherboard based system, so I can't imagine why it would be locked down to boot Windows only. This is the first time in these discussions that the Microsoft Option ROM UEFI CA 2023 showed up. When I looked it up, it wasn't clear exactly what it's function is.
I found what appears to be a simple update of the Windows Boot Manager, so I gave it a shot. This is on Microsoft's site, so one would presume it's good.

Updating Microsoft Secure Boot keys | Windows IT Pro blog

A new Microsoft Windows UEFI CA 2023 will replace the existing Windows Production 2011 CA.

techcommunity.microsoft.com

I checked, and the Secure-Boot-Update file was indeed in the proper folder with a March 2025 date.

I ran the two commands in an Administrative PowerShell window, they completed without any errors.

I booted the machine twice as instructed, then I ran the check command.

The check command says the update worked, so I figure I'm all set.

I ran the check script again, and no Boot Manager 2023 allowed. Not sure where I went wrong.

bikemanAMD · Jul 30, 2025

uncyler825 said:
If you are familiar with BIOS operation, you can manually delete the SVN Key from the Key Management. If you want to add SVN again, run the SVN firmware update, and then the SVN Key will be updated to DBX again.

Tiny Bit familiar with Bios operation, no means an expert, but good to know on that if it comes to it in the future.

normally i just set my settings, or do a simple UEFI bios update, and then not in there too much

uncyler825 · Jul 30, 2025

If SVN key is applied, it will also cause security violations in Windows 11 23H2 and Windows 10 22H2. Currently, only ISOs built from UUP that have been updated to July 8, 2025 - KB5062553 (OS Build 26100.4652) or later can correctly use the new Windows Boot Manager in the second stage. You do not need to turn off Secure Boot again.

uncyler825 · Jul 30, 2025

gunrunnerjohn said:
I ran the check script again, and no Boot Manager 2023 allowed. Not sure where I went wrong.

View attachment 140912

Update the Boot Manager on your device.

This step will install a boot manager application on your device which is signed with the “'Windows UEFI CA 2023” certificate.

Set the regkey to install the “'Windows UEFI CA 2023” signed boot manager. To do this, open a Command Prompt window as an Administrator, type each of the following commands separately, and then press Enter:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f

Code:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

gunrunnerjohn · Jul 30, 2025

uncyler825 said:
If SVN key is applied, it will also cause security violations in Windows 11 23H2 and Windows 10 22H2. Currently, only ISOs built from UUP that have been updated to July 8, 2025 - KB5062553 (OS Build 26100.4652) or later can correctly use the new Windows Boot Manager in the second stage. You do not need to turn off Secure Boot again.

Yep, that is indeed installed.

This is 24H2.

uncyler825 said:
Update the Boot Manager on your device.

This step will install a boot manager application on your device which is signed with the “'Windows UEFI CA 2023” certificate.

Set the regkey to install the “'Windows UEFI CA 2023” signed boot manager. To do this, open a Command Prompt window as an Administrator, type each of the following commands separately, and then press Enter:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f

Code:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

Isn't that what the procedure I did in the previous post was supposed to do?

I followed the steps in that new page with one exception. When I ran the Start-Scheduled-Task it got an error in a administrative command window

However, it runs successfully if I run it in a administrative PowerShell window.

The certificate check appears to be proper, the 2023 certificate is there.

And....

SUCCESS!

Not sure why the other procedure didn't work.

I presume this means I can revoke the 2011 certificate and still boot with Secure Boot.

uncyler825 · Jul 30, 2025

gunrunnerjohn said:
Isn't that what the procedure I did in the previous post was supposed to do?

I followed the steps in that new page with one exception. When I ran the Start-Scheduled-Task it got an error in a administrative command window

View attachment 140919

However, it runs successfully if I run it in a administrative PowerShell window.

And....

SUCCESS!

Not sure why the other procedure didn't work.

I presume this means I can revoke the 2011 certificate and still boot with Secure Boot.

Start-ScheduledTask is a PowerShell command. You can use PS to execute these steps. PS also recognizes CMD.EXE commands.

You can revoke the CA 2011 certificate. However, you may experience security violations when using a retail Windows 11 ISO to clean install your system.

gunrunnerjohn · Jul 30, 2025

uncyler825 said:
Start-ScheduledTask is a PowerShell command. You can use PS to execute these steps. PS also recognizes CMD.EXE commands.

You can revoke the CA 2011 certificate. However, you may experience security violations when using a retail Windows 11 ISO to clean install your system.

I had done a "RESET" of my mini-PC using the on-line option, and it magically did this update for me and the 2023 certificate was there and secure boot was working.

I'm assuming that Microsoft will have new ISO images that include the proper boot files at some point in the near future. Am I right to assume if in the near future while this is still in flux at MSC, if I disable Secure Boot I could still boot until I sorted it out?

One thing I haven't seen is how to remove a certificate from the revocation database, is that somehow possible.

uncyler825 · Jul 30, 2025

If Microsoft does not patch a compatible new Boot Manager security update for Windows 10 22H2 and Windows 11 23H2, users of the CA 2011 + SVN dual mechanism will encounter security violations issues and will have to temporarily disable Secure Boot to clean installation in the future.

My choice. I deleted the Microsoft KEK certificate to prevent Windows Update from revoking the CA 2011 certificate and SVN. I am still on Windows 11 23H2, I don’t like to disable Secure Boot when doing a clean installation.

gunrunnerjohn · Jul 30, 2025

I guess I can just wait and see what MSC does with all of this. Right now I suspect I'm still using the 2011 certificate, but so are a cast of millions of other users.

Expiration date	Expiring certificate	Updated certificate	What it does	Storing location
June 2026	Microsoft Corporation KEK CA 2011	Microsoft Corporation KEK 2K CA 2023	Signs updates to DB and DBX	KEK
June 2026	Microsoft Corporation UEFI CA 2011 (or third-party UEFI CA)*	a) Microsoft Corporation UEFI CA 2023 b) Microsoft Option ROM UEFI CA 2023	a) Signs third-party OS and hardware driver components b) Signs third-party option ROMs	DB
Oct 2026	Microsoft Windows Production PCA 2011	Windows UEFI CA 2023	Signs the Windows bootloader and boot components	DB

Act now: Secure Boot certificates expire in June 2026

Recap: Why Secure Boot requires updating​

The change: Expiring certificates​

The impact and implications​

Take action today​

Enterprise IT-managed systems that send diagnostic data​

Enterprise IT-managed systems that don't send diagnostic data​

Systems with Secure Boot disabled​

Change management considerations​

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

Attachments

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Similar threads

Recap: Why Secure Boot requires updating

The change: Expiring certificates

The impact and implications

Take action today

Enterprise IT-managed systems that send diagnostic data

Enterprise IT-managed systems that don't send diagnostic data

Systems with Secure Boot disabled

Change management considerations