Did you manually update your Secure Boot Keys ?

gunrunnerjohn · Wednesday at 10:57 AM

Levitate11 said:
@garlin : Here's my output:

EFI DB Certificates ------------------- Microsoft Windows Production PCA 2011 Windows UEFI CA 2023 Microsoft Corporation UEFI CA 2011 Microsoft UEFI CA 2023

So, the fact that they installed in the 2011 certificate before they installed the 2023 certificate means that I'm still vulnerable to the BlackLotus hack around Secure Boot?

I just ran this script, I get a slightly different output. Not sure of the significance, but I only get the 2023 certificate once. Not sure why it's listed twice on your output.

EFI DB Certificates
-------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Windows UEFI CA 2023

EFI DBX Certificates
--------------------

AvailableUpdates: 0x0
---------------------

EFI Files
---------
Boot Manager [Windows UEFI CA 2023] on Disk 1 is allowed.

garlin · Wednesday at 11:08 AM

You're supposed to have both CA 2023 certs. Windows CA 2023 is what's immediately needed for booting the new boot files.

The non-Windows cert is used to sign non-MS OS'es like Linux (which may be useful if you're booting a live Linux USB to perform a repair). I'm not going to pretend I understand why some users don't see all 4 certs. It's either a specific BIOS problem, or MS needs to tweak the update process because some BIOS'es are having issues.

gunrunnerjohn · Wednesday at 11:33 AM

I thought that might be the case, I've never noticed it as I haven't booted any 3rd party systems.

Cameraman1955 · Wednesday at 12:05 PM

garlin said:
Here's a PowerShell script to report your current certs:
Did you manually update your Secure Boot Keys ?

Yes I did with powershell, the laptop get no bios updates anymore.

gunrunnerjohn · Wednesday at 12:21 PM

garlin said:
You're supposed to have both CA 2023 certs. Windows CA 2023 is what's immediately needed for booting the new boot files.

The non-Windows cert is used to sign non-MS OS'es like Linux (which may be useful if you're booting a live Linux USB to perform a repair). I'm not going to pretend I understand why some users don't see all 4 certs. It's either a specific BIOS problem, or MS needs to tweak the update process because some BIOS'es are having issues.

Can't see anything in the Gigabyte BIOS to enable the Microsoft version, so I'm not sure what I do at this point. Maybe hope I don't want to boot anything but Windows? I guess if push comes to shove, I just turn off Secure Boot for a non-MS system or device.

garlin · Wednesday at 12:26 PM

Interestingly, MS actually has a Secure Boot update script which doesn't need any KB updates. That's always been possible, but someone finally wrote an official standalone script.

secureboot_objects/scripts/windows/InstallSecureBootKeys.ps1 at main · microsoft/secureboot_objects
secureboot_objects/PostSignedObjects at main · microsoft/secureboot_objects

I would not try this on your own, unless you're seriously experienced with updating BIOS firmware.

My point is there's a possible way to redo the process in case the KB update method doesn't work right. Presuming your PC's correct (and that's the sticking point) firmware files have been shared with MS on the GitHub repository folders. This would fix the problem of missing CA 2023 certs or KEK keys.

gunrunnerjohn · Wednesday at 12:35 PM

Well... I read the blurb on that, and it looks like it would be easy to shoot yourself in the foot screwing with that process!

Where do you find the MS update?

garlin · Wednesday at 12:49 PM

The GitHub is provided as a public service for MS partners, and isn't intended for home users. That's because none of the firmware file versions are labeled as "works on model XYZ motherboard or PC".

The tools for running the Secure Boot update process have been bundled inside the Monthly Update since at least June 2024. But there's only one way to run the process: change a reg a bunch of times, force a bunch of reboots, and hope it worked.

For most users, the process should be smooth. What's not clear is how to clean up the cases where something wasn't updated. The fact that MS is quietly collecting UEFI bin files from the OEM's in a public place indicates they're planning ahead. Their undocumented script rolls out the updates, but it doesn't do the important job of picking which bin file is the one for your PC.

Which means the puzzle pieces are there, and at some point there's a list of which bin files match which PC's. So stay tuned...

gunrunnerjohn · Wednesday at 2:20 PM

garlin said:
Which means the puzzle pieces are there, and at some point there's a list of which bin files match which PC's. So stay tuned...

Yep, in looking at the stuff at GitHub didn't look all that certain to not nuke me without more information, so I passed.

Since I have booted my USB drive with a Windows Image and Windows itself with Secure Boot enabled, I can afford to wait right now.

OldNavy · Wednesday at 2:23 PM

Just like gunrunnerjohn, this all looks a tricky for my computer skills and i don't want to brick my computer.
I'll leave it until MS does something really really simple for me.

gunrunnerjohn · Wednesday at 2:30 PM

OldNavy said:
Just like gunrunnerjohn, this all looks a tricky for my computer skills and i don't want to brick my computer.
I'll leave it until MS does something really really simple for me.

I doubt I'd brick the computer, but I can see it screwing up enough for me to spend a lot of time screwing around with it. My two computers have the Gigabyte Q-Flash Plus which allows you to recover from a corrupted BIOS and load a good copy.

Cameraman1955 · Thursday at 3:47 AM

This is the output of my laptop, I think I am ok now, thanks for the script @garlin

cheaterslick · Thursday at 7:29 AM

gunrunnerjohn said:
Where do you find the MS update?

Yeah, I'd rather do that through a KB, too.

gunrunnerjohn · Thursday at 10:06 AM

Cameraman1955 said:
This is the output of my laptop, I think I am ok now, thanks for the script @garlin

View attachment 138911

Same thing I get, I'd just like to figure out how to get the Microsoft 2023 certificate, but I'm not going to do handstands to get there. :) Both of my Windows 11 computers get the same list.

Cameraman1955 · Thursday at 1:56 PM

gunrunnerjohn said:
Same thing I get, I'd just like to figure out how to get the Microsoft 2023 certificate, but I'm not going to do handstands to get there. :) Both of my Windows 11 computers get the same list.

Was the Microsoft CA 2023 for other os am I right?

gunrunnerjohn · Thursday at 2:58 PM

Cameraman1955 said:
Was the Microsoft CA 2023 for other os am I right?

That's my understanding, I know I haven't missed it so far.

AncientParadise · Thursday at 5:25 PM

Hello.

I have Windows 10 Pro (x64).

I used the script from the person named "garlin", and noticed only the certificates from 2011. Then, I installed Microsoft's Monthly Update for July, and checked again. The script still showed only the certificates from 2011.

Imagine that my old computer won't ever receive the new certificates, so the operating system, and new programs that use a new certificate, won't work. If I'll disable Secure Boot, could I gain access to Windows 10, and new programs that use a new certificate, again?

garlin · Thursday at 5:56 PM

AncientParadise said:
I used the script from the person named "garlin", and noticed only the certificates from 2011. Then, I installed Microsoft's Monthly Update for July, and checked again. The script still showed only the certificates from 2011.

Imagine that my old computer won't ever receive the new certificates, so the operating system, and new programs that use a new certificate, won't work. If I'll disable Secure Boot, could I gain access to Windows 10, and new programs that use a new certificate, again?

The current Monthly Update includes the updated boot files and tools to install the new certs, but it's not done automatically for you. We're in an "opt in" period, and if you would like to perform the cert update, then follow the process here:

TPM 2.0 Devices and remediation of CVE-2023-24932 (Black Lotus) UEFI / Secure Boot Vulnerability. - Help for those with "Known Issues"

Run all the provided commands using a CMD window, opened as the Administrator.

man00 · Thursday at 6:51 PM

Complete totally confused

gunrunnerjohn · Thursday at 8:05 PM

man00 said:
Complete totally confused

Yep, if Microsoft was trying to make this process easier, we can chalk it up to a monster fail!

Did you manually update your Secure Boot Keys ?

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Similar threads