Hi all. Hoping someone experienced with the Secure Boot 2023 certificate rollout can help.
System info:
Laptop: MSI Katana GF76 12UD (MS-17L4), BIOS E17L4IMS.10E (06/2022, never updated)
CPU: Intel Core i5-12500H, TPM = Intel PTT
RAM: 24 GB DDR4, GPU: RTX 3050 Ti Laptop, 512 GB NVMe SSD
Windows 11, fully updated (exact build unknown – the PC can’t boot)
Timeline:
- BitLocker (device encryption) was enabled automatically. TPM-only protector, sealed 2026-09-24 (shown on the recovery screen) – most likely right after Windows applied the Windows UEFI CA 2023 db update.
- Yesterday the BIOS settings reset (date went to 04/01/2024, likely CMOS). Secure Boot keys returned to factory defaults (Factory Default Key Provisioning: Enabled).
- Boot went to BitLocker recovery: error 7_3_80000001_80000001_db_db_7_7_19c4…13eb_2d64…f21c. So PCR7 event #3 (db) mismatches, PK and KEK match. Expected db digest 19c4…13eb, observed 2d64…f21c.
- With Secure Boot enabled, the boot manager now fails (“Secure Boot Violation: Invalid signature”) because it’s signed by Windows UEFI CA 2023, which the factory db lacks. Secure Boot is currently disabled (now error E_FVE_SECURE_BOOT_DISABLED, PCR7 event 0).
We don’t have the recovery key. TPM has NOT been cleared, the drive is untouched. We have a Mac and can make an Ubuntu live USB to run any commands needed.
Plan: re-append to db exactly what Windows added (signed payloads from microsoft/secureboot_objects), so db hashes to 19c4…13eb, then re-enable Secure Boot and let TPM unseal.
Questions:
- Which db payloads does Windows apply, and in what order (Windows UEFI CA 2023 only, or also Microsoft UEFI CA 2023 / Option ROM CA 2023)? Would dbx have been updated too before 24.09?
- Best way to append them on an MSI/AMI board: Ubuntu live USB with efi-updatevar -a, or something else?
- Can we pre-compute the db event digest offline (from the factory db dump + candidate ESLs) to verify against 19c4…13eb before writing?
Any help hugely appreciated – critical documents on the drive.
