Adding CA Certificates to Mini PC with N150 processor

I ran the Check_EFIBootFile.ps1 script on my Mini PC with the N150 processor and got nothing but errors. This is Win11 Pro 24H2, build 26100.4652. It appears I don't have any of the certificates on this machine. Yes, Secure Boot is not enabled.

Shouldn't I at least have the 2011 certificates?



Secure Boot: DISABLED
Get-SecureBootUEFI : Variable is currently undefined: 0xC0000100
At C:\BAT\Check Boot CA Certificates\Check_EFIBootFile.ps1:199 char:16
+ $db_Certs = @((Get-SecureBootUEFI db | Get-UefiDatabaseSignatures).Si ...
+ ~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (Microsoft.Secur...BootUefiCommand:GetSecureBootUefiCommand) [Get-S
ecureBootUEFI], StatusException
+ FullyQualifiedErrorId : GetFWVarFailed,Microsoft.SecureBoot.Commands.GetSecureBootUefiCommand


EFI DB Certificates
-------------------
Get-SecureBootUEFI : Variable is currently undefined: 0xC0000100
At C:\BAT\Check Boot CA Certificates\Check_EFIBootFile.ps1:206 char:17
+ $dbx_Certs = @((Get-SecureBootUEFI dbx | Get-UefiDatabaseSignatures). ...
+ ~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (Microsoft.Secur...BootUefiCommand:GetSecureBootUefiCommand) [Get-S
ecureBootUEFI], StatusException
+ FullyQualifiedErrorId : GetFWVarFailed,Microsoft.SecureBoot.Commands.GetSecureBootUefiCommand


EFI DBX Certificates
--------------------

AvailableUpdates: 0x40
----------------------
Install the updated certificate definitions to the DB.
Cannot index into a null array.
At C:\BAT\Check Boot CA Certificates\Check_EFIBootFile.ps1:165 char:12
+ return $Matches[2]
+ ~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : NullArray


EFI Files
---------
Boot Manager [] on Disk 0 is allowed.

What happens when you run this command as Administrator?

Whether SecureBoot is enabled or not, the UEFI settings for DB & DBX should be readable. Unless you got some weird BIOS problems. Does the same command work if you temporarily enabled Secure Boot?

I get this. Note that this command works on both of my regular desktop PC's with AMI BIOS versions.

Get-SecureBootUEFI : Variable is currently undefined: 0xC0000100
At line:1 char:1
+ Get-SecureBootUEFI db
+ ~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (Microsoft.Secur...BootUefiCommand:GetSecureBootUefiCommand) [Get-S
ecureBootUEFI], StatusException
+ FullyQualifiedErrorId : GetFWVarFailed,Microsoft.SecureBoot.Commands.GetSecureBootUefiCommand

Sounds like a BIOS issue. Check if your Mini PC has a BIOS update you can reflash with.

garlin said:

Sounds like a BIOS issue. Check if your Mini PC has a BIOS update you can reflash with.

Click to expand...

I actually did that, and it seems I have the latest BIOS. I hope that MS doesn't require secure boot anytime soon since I can't see how I'll update this one.

Does it have an option for BIOS factory reset?

garlin said:

Does it have an option for BIOS factory reset?

Click to expand...

I'll have to check if it has a true BIOS reset, I don't have it connected to a monitor right now, I'm running RDP to control it. It's going to be a video player for a pair of monitors when I get it all configured.

A BIOS reset did nothing but invalidate my PIN, but I can actually create a PIN, so it has to have at least some of the certificates, right?

You would have to check from the UEFI settings.

I think I'll wait and see what Microsoft does as far as the updates for the certificates. Obviously there is something different about the AMI BIOS in this mini because it looks totally different than the other AMI BIOS versions I've seen.

Hmm, just speculation on my part, but there are a LOT of Mini PCs out there that have a BIOS that falsely reports to Windows that they have the ability to do Secure Boot but have no way to actually enable Secure Boot in the BIOS. I wonder if that could cause this.

I'll have to test that as I have multiple Mini PCs just like that.

Do you actually see any option for Secure Boot in the BIOS?

hsehestedt said:

Hmm, just speculation on my part, but there are a LOT of Mini PCs out there that have a BIOS that falsely reports to Windows that they have the ability to do Secure Boot but have no way to actually enable Secure Boot in the BIOS. I wonder if that could cause this.

I'll have to test that as I have multiple Mini PCs just like that.

Do you actually see any option for Secure Boot in the BIOS?

Click to expand...

I did enable Secure Boot in the BIOS, and Windows thinks I have Secure Boot. I did reset the "keys" in the BIOS and had to reset my PIN login, that seemed to indicate that the keys were regenerated.

I can't imagine why they wouldn't use a BIOS that supports Secure Boot, surely they know it's coming. I can see if their support can answer the question.

Appears to be common with cheap Mini PC's.
Secure Boot not enabled in new MiniPC - Win 11 setup without Secure Boot

I just wonder what the issue will be when they decide to enforce the secure boot requirement...

garlin said:

Appears to be common with cheap Mini PC's.
Secure Boot not enabled in new MiniPC - Win 11 setup without Secure Boot

Click to expand...

Well, as it turns out, this is not one of the mini PC's that don't have secure boot. I installed the new certificates and all seems well, Windows boots normally without errors. All the certificates look fine when I check them, and secure boot is enabled and HWiNFO says it is as well when I boot. One little niggling thing that still bothers me. Whenever I reset the certificates with the other two systems, I had to re-do my PIN before I could use it, but on this machine, the PIN stayed intact through the process. I was a little surprised that was the case.

In order to get the BIOS mind right I had to tinker with the Secure boot settings several times and reboot.

garlin said:

What happens when you run this command as Administrator?

Code:

powershell -C "Get-SecureBootUEFI db"

Whether SecureBoot is enabled or not, the UEFI settings for DB & DBX should be readable. Unless you got some weird BIOS problems. Does the same command work if you temporarily enabled Secure Boot?

Click to expand...

I did this on my main system and on the new mini PC. Got the exact same results.

powershell -C "Get-SecureBootUEFI db"



From all appearances, it appears to be fully updated.

Sigh. I was so gung-ho on this issue back when the initial phases of mitigations for blacklotus where implemented, going so far as to automate the whole process. Now, I'm simply considering not bothering until MS forces the updates. I'm getting tired of wasting all my time patching stuff.

hsehestedt said:

Sigh. I was so gung-ho on this issue back when the initial phases of mitigations for blacklotus where implemented, going so far as to automate the whole process. Now, I'm simply considering not bothering until MS forces the updates. I'm getting tired of wasting all my time patching stuff.

Click to expand...

I'm beginning to think the same thing. I spent more time on this that it deserves. I'm not really in a high risk environment here.

@gunrunnerjohn @hsehestedt Welcome to my club. The deciding factor to my choice of running with SB off and not jacking with the revocations was
3-fold, at first my total lack of understanding of the why, the second I was going in circles trying to figure out how to manually apply them without borking something, and thirdly, after I finally did get a semblance of understanding I felt it was something I was not very vulnerable to being affected by.

Once I am forced to turn SB on, I will and MS can darn well download and apply them if I absolutely have to have them.

@gunrunnerjohn I get the same response from the PS command as you do.
Regarding your minPC, I have a Beelink, it came with SB off. I think maybe it was because Beelink had used some unorthodox method of loading a customized version of Windows 11 Pro VL into this machine. The OS was lacking some apps. I was scared of the volume license even though I acquired the license key from Beelink. I bought a cheap PRO key instead and changed it. I do not believe there is any key embedded in the uefi bios as in other OEM machines. While the mini works fine, has as great cpu, ram, and large nvme, color me unimpressed with everything else. It's bios are the most basic I have ever seen.

glasskuter said:

@gunrunnerjohn I get the same response from the PS command as you do.
Regarding your minPC, I have a Beelink, it came with SB off. I think maybe it was because Beelink had used some unorthodox method of loading a customized version of Windows 11 Pro VL into this machine. The OS was lacking some apps. I was scared of the volume license even though I acquired the license key from Beelink. I bought a cheap PRO key instead and changed it. I do not believe there is any key embedded in the uefi bios as in other OEM machines. While the mini works fine, has as great cpu, ram, and large nvme, color me unimpressed with everything else. It's bios are the most basic I have ever seen.

Click to expand...

My mini is the ACEMAGIC Vista V1, it has the N150 processor 16GB of memory and a 1TB NVMe drive. It's a decent little box, and actually has similar performance to the old HP Envy desktop with Core i7 3770 processor that I used for years. The NVMe drives are much faster than the SATA SSD's I was using as well. AFAIK, mine has the full Win11 Pro, I haven't seen any missing parts over the other computers that I loaded from ISO versions direct from Microsoft.

I don't think that anything was ever setup in the BIOS for the certificates out of the gate, so there were no certificates for them to find. Since going through the process ( several times ) I got everything laying flat. I have decided not to continue tinkering with this, I'll wait until some guidance comes along on invalidating the 2011 certificates. I managed to get all three computers updated with the 2023 certificates without breaking the boot process, so I'll let sleeping dogs lie.

The BIOS in my mini was "middle of the road" I guess. Not as elaborate as the ones in my Gigabyte motherboards, but it did have many of the tuning parameters. It is a more primitive text based presentation, but as long as it works. It doesn't seem to have a "boot menu" key, or at least it wasn't any of the common AMI keys so I had to keep setting the boot sequence to get the USB to boot first, but I got the job done. I tried the ESC, F2, and F12 keys, none of them were recognized by the BIOS. However, the DEL key gets you into the BIOS, so I could work around that.