Did you manually update your Secure Boot Keys ?

Almighty1 · Sep 19, 2025

mccmw said:
Would downloading an ISO from Microsoft and doing an in-place upgrade/repair result in updated UEFI/secure boot keys?

The answer is no as I already tried it a few times, the files are there but you have to still manually do the process.

Almighty1 · Sep 19, 2025

garlin said:
Any bootable drives (ISO or USB Recovery) created before this time will need to have replacement boot files copied to them. If you have the newer boot files installed on Windows, then make a new Macrium Recovery USB.

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

Have a question about this one, for the ISO or USB Recovery, what replacement boot files needs to be copied?

garlin · Sep 19, 2025

antspants said:
I have no idea if I am progressing...

You're ready to add CA 2011 to DBX, this where MS expects you to be in their current timetable.

garlin · Sep 19, 2025

Almighty1 said:
Have a question about this one, for the ISO or USB Recovery, what replacement boot files needs to be copied?

CA 2023 files:

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi H:\EFI\boot\bootx64.efi

CA 2011 files (to revert changes):

Code:

copy C:\Windows\Boot\EFI\bootmgfw.efi H:\EFI\boot\bootx64.efi

Almighty1 · Sep 19, 2025

Here's mine:

Is this one supposed to detect Microsoft Option ROM UEFI CA 2023?

garlin · Sep 19, 2025

Almighty1 said:
Is this one supposed to detect Microsoft Option ROM UEFI CA 2023?

No, but this version will.

Almighty1 · Sep 19, 2025

garlin said:
No, but this version will.

And it works but it seems there is something that needs fixing in the file:

garlin · Sep 19, 2025

Fixed. Thanks.

RJARRRPCGP · Sep 19, 2025

Looks like we missed a lot of the official documentation!

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

Almighty1 · Sep 19, 2025

garlin said:
Fixed. Thanks.

Works fine now... Thanks!

RJARRRPCGP · Sep 19, 2025

Looks like we have an official way to add the updated boot loader and add the 2011 certs to the DBX.

The only problem is this: Looks like if the BIOS gets reset on socket AM4 systems, and older than socket 1700 systems, especially, then you need to run a special recovery procedure to re-add the 2023 certs!

Because the 2011 certs will get reinstalled and the 2023 certs will get deleted, like they never existed in the first place!

Almighty1 · Sep 19, 2025

AK6DN said:
Yes, secure boot is set to to UEFI and CSM is disabled. It does secure boot to Win10 no problem.

Mosby has an option to insert new private platform key certificates unique to your system when updating the standard cert's.
You can enable it or not. I enabled it, so it overwrote the standard manufacturer BIOS resident key certificates.
That is what the 'MosbyKey' is that is causing the Check_EFIBootFile.ps1 script to go sideways.
There is also the option in Mosby to leave the current system BIOS certificates alone (maybe that would have been a better choice IDK).
If I get up enough energy and courage to (possibly) brick my system (IDK) I may try resetting the BIOS to default keys and rerun Mosby
to not generate new keys but use the existing BIOS keys. We;ll see,

How do you enable or not enable the private platform key certificates in Mosby?

Almighty1 · Sep 19, 2025

On secureboot_objects/PostSignedObjects/Optional/DB/amd64 at main · microsoft/secureboot_objects - there are the following files:
DBUpdate3P2023.bin which I believe is Microsoft Corporation UEFI CA 2023 (db) and Windows UEFI CA 2023 (db)
DBUpdateOROM2023.bin which is Microsoft Option ROM UEFI CA 2023 (db)

There is also something named DBUpdate2024.bin which is DB2024 and DBX2024, any one have any ideas what this is?

Here is where it gets even more confusing, using Dell for example at:

secureboot_objects/PostSignedObjects/KEK/Dell at main · microsoft/secureboot_objects

Secure boot objects recommended by Microsoft. Contribute to microsoft/secureboot_objects development by creating an account on GitHub.

github.com

KEKUpdate_Dell_PK1.bin
KEKUpdate_Dell_PK2.bin
KEKUpdate_Dell_PK3.bin
KEKUpdate_Dell_PK4.bin

which file would one actually use? or does one have to use all 4? Is this actually the PK or the Microsoft Corporation KEK 2K CA 2023 (kek)?

Scott · Sep 19, 2025

RJARRRPCGP said:
Looks like we missed a lot of the official documentation!

Same document I used 2 years ago.

garlin · Sep 19, 2025

Almighty1 said:
Here is where it gets even more confusing, using Dell for example at:

secureboot_objects/PostSignedObjects/KEK/Dell at main · microsoft/secureboot_objects

Secure boot objects recommended by Microsoft. Contribute to microsoft/secureboot_objects development by creating an account on GitHub.

github.com

KEKUpdate_Dell_PK1.bin
KEKUpdate_Dell_PK2.bin
KEKUpdate_Dell_PK3.bin
KEKUpdate_Dell_PK4.bin

which file would one actually use? or does one have to use all 4? Is this actually the PK or the Microsoft Corporation KEK 2K CA 2023 (kek)?

Dell has been living under multiple fictitious aliases all these years. From the JSON file in the parent folder:

Code:

    "38a346b84c0e230ca4f235e7355b872460770264": {
        "KEKUpdate": "Dell\\KEKUpdate_Dell_PK1.bin",
        "Certificate": {
            "serial_number": 37089758067383681231089766501132234704,
            "issued_to": "CN=Dell Technologies Inc. Platform Key,OU=Dell PowerEdge BIOS,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US",
            "issued_by": "CN=Dell Technologies Inc. Platform Key,OU=Dell PowerEdge BIOS,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US"
        }
    },
    "ff7116ca01ea3196718a9e785179a0e553ace1ee": {
        "KEKUpdate": "Dell\\KEKUpdate_Dell_PK2.bin",
        "Certificate": {
            "serial_number": 65750570568331588544559574117537346272,
            "issued_to": "CN=Dell Technologies Inc. Platform Key Gen16 3K,OU=Dell Infrastructure Solutions Group,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US",
            "issued_by": "CN=Dell Technologies Inc. Platform Key Gen16 3K,OU=Dell Infrastructure Solutions Group,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US"
        }
    },
    "44d641caca0809002398b4877b8e982ed26f7b76": {
        "KEKUpdate": "Dell\\KEKUpdate_Dell_PK4.bin",
        "Certificate": {
            "serial_number": 107178043412767137806353942672049334433,
            "issued_to": "CN=Dell Inc. Platform Key,O=Dell Inc.,L=Round Rock,ST=Texas,C=US",
            "issued_by": "CN=Dell Inc. Platform Key,O=Dell Inc.,L=Round Rock,ST=Texas,C=US"
        }
    },

You would think someone at MS is smart enough to write a tool or script for us...

RJARRRPCGP · Sep 19, 2025

Scott said:
Same document I used 2 years ago.

The page I was getting, only had the ones to put the 2023 cert into the DB. Not even for any of the others.

Scott · Sep 20, 2025

RJARRRPCGP said:
The page I was getting, only had the ones to put the 2023 cert into the DB. Not even for any of the others.

Here's where I learned of all of this, from a @Brink thread from May 2023.
He linked to the same MS support page you did.

Additional guidance for devices using Secure Boot to address CVE-2023-24932

Microsoft Support: UPDATE 7/11: Second Deployment This phase starts with updates released on July 11, 2023, which adds additionally support mitigating the issue. Security updates released May 9, 2023 and later contain security hardening changes to protect against vulnerabilities tracked by...

www.elevenforum.com

antspants · Sep 20, 2025

garlin said:
You're ready to add CA 2011 to DBX, this where MS expects you to be in their current timetable.

Not sure if I have seen that process in this thread, or if I did, can’t seem to find it.

gunrunnerjohn · Sep 20, 2025

garlin said:
Fixed. Thanks.

Might I suggest you put revision numbers on the file names so you can figure out the latest version? At least put a short comment section in the file with the current date and a revision history.

garlin · Sep 20, 2025

Will do. This script has taken a life of its own, it started as a quick tool for checking your progress thru the MS mitigation steps.

Did you manually update your Secure Boot Keys ?

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computers

Well-known member

My Computer

Similar threads