Completing the Secure Boot Certificate Conversion

OK, I have the 2023 Certificates installed and secure boot enabled. How do I "complete" the conversion and get Windows booting using the 2023 certificate? I installed Windows initially in March, but it automatically did a repair a couple days ago during the last update, so now it thinks it was installed Aug 28th. I am presuming that Windows will recognize the 2023 secure boot certificate at this point, but how to I check to make sure?

If that checks OK, what's the next step to get it actually using the certificate instead of the 2011 certificate for the secure boot?

How did you get the Windows UEFI CA 2023 certificate installed in the DB?


Step 2 in the above process is the one that signs the EFI bootfile with the Microsoft UEFI 2023 CA certificate and initiates booting using it.

I am strongly advised to not do step 3 (revoking trust of the 2011 certificate) unless you have a special need for it and create USB boot disks signed using the 2023 certificate since you can't use any with EFI bootfiles signed with the (now untrusted) 2011 certificate going forward. As explained to me, if you do not revoke trust in it the system will still boot in Secure Boot mode using a boot file signed with the 2011 certificate when needed, even if it is expired. It should still boot with Secure Boot disabled, or in CSM mode.

There is another thread on this in the Antivirus, Firewalls and Security forum covering this in detail. It's long and confusing, with several deep-dives into highly peculiar scenarios using third party scripts. You can try to follow it, I nearly got myself into trouble by doing so (I revoked the 2011 certificate and had to figure out how to recover from that).

I think it's really only important to have the 2023 certificates in your DB. That way they can be used for signing binaries, usually at a time Microsoft comes out with security updates.