Did you manually update your Secure Boot Keys ?

DarkShadowMD · Sep 15, 2025

FIREMEDIC2700 said:
lets be honest here. does the average computer user even need secure boot . Other than being a extra level of security what else is it good for ?

Sadly, if you game, and you are addicted to games that use anti cheat tech, you need this enabled...

DarkShadowMD · Sep 15, 2025

uncyler825 said:
The certificate can be updated through Windows Update.

In fact, if you are a user who has built computer motherboard in recent years, they already include CA 2023 certificates. Motherboard manufacturers have already pre-installed CA 2023 certificates on newly produced motherboards. However, motherboard manufacturers will not revoke CA 2011 certificates. We should follow Microsoft's revocation schedule.

I know. But it still has some issues to work out. And not everyone wants to download Windows ISOs from UUP dump.

I built my Desktop PC's in 2023, the parts were bought between March and November that year, especially the motherboards, which are some MSI B550M Pro-VDH-WiFi. Those have the certificates already?

Will this apply to laptops bought the same year, like mine?

Marcus Vinicus · Sep 15, 2025

FerchogtX said:
Sadly, if you game, and you are addicted to games that use anti cheat tech, you need this enabled...

What is so sad about it?

HeavyHemi · Sep 15, 2025

I ran the commands from the OP and my relatively ancient EVGA FTW K X99 board updated with no issues.
Edit... I didn't save an image but prior to updating, this command read false.

DarkShadowMD · Sep 15, 2025

Marcus Vinicus said:
What is so sad about it?

This mess with certificates expiring and determining whether you do anything or you let Windows Update do it... or nothing happens, or your PC becomes a brick lol...

garlin · Sep 15, 2025

Marcus Vinicus said:
What is so sad about it?

What's sad is cheating so prevalent, that game publishers resort to enforcing Secure Boot/CI even though that probably steals some FPS perf.

RJARRRPCGP · Sep 15, 2025

Question: Do you add the KEK as a public key? This is for people whose BIOSes have such description.

The options in my BIOS, are: public key or variable.

I chose as a public key, and it showed that the KEK was inserted.

AK6DN · Sep 15, 2025

I finally broke down and went the Mosby route on my Lenovo T530 laptop.
Prior to using Mosby it was stuck with just circa 2011 certificates in KEK and DB.

Ref: GitHub - pbatard/Mosby: Mosby – More Secure Secure Boot

After Mosby, I get this:

Code:

C:\WINDOWS\system32>powershell -nop -ep bypass -f C:\Downloads\Check_EFIBootFile.ps1

Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 1: Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] is in UEFI DB.

C:\WINDOWS\system32>pause done

AK6DN · Sep 16, 2025

garlin said:
Thanks. I forgot to mention the script reports if you've (optionally) suspended BitLocker for [N] reboots.
h/t to @hsehestedt

Ok, so your script was running fine yesterday. But today I see this when I ran it ...

Code:

C:\WINDOWS\system32>powershell -nop -ep bypass -f C:\Downloads\Check_EFIBootFile\Check_EFIBootFile.ps1
Secure Boot: ON
BitLocker on (C:) OFF
ERROR: Failed to read UEFI Secure Boot settings.

C:\WINDOWS\system32>pause done
Press any key to continue . . .

System runs and boot fine in UEFI secureboot. No apparent issues.
Using individual commands to check and see if cert's are present returns 'true' for each of them.
Very strange.

garlin · Sep 16, 2025

What happens when you run these PS commands as Admin?

Code:

Get-SecureBootUEFI KEK
Get-SecureBootUEFI db
Get-SecureBootUEFI dbx

AK6DN · Sep 16, 2025

garlin said:
What happens when you run these PS commands as Admin?

Code:

Get-SecureBootUEFI KEK Get-SecureBootUEFI db Get-SecureBootUEFI dbx

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Try the new cross-platform PowerShell https://aka.ms/pscore6

PS C:\WINDOWS\system32> Get-SecureBootUEFI KEK

Name Bytes                  Attributes
---- -----                  ----------
KEK  {161, 89, 192, 165...} NON VOLATILE...


PS C:\WINDOWS\system32> Get-SecureBootUEFI db

Name Bytes                  Attributes
---- -----                  ----------
db   {161, 89, 192, 165...} NON VOLATILE...


PS C:\WINDOWS\system32> Get-SecureBootUEFI dbx

Name Bytes                 Attributes
---- -----                 ----------
dbx  {38, 22, 196, 193...} NON VOLATILE...


PS C:\WINDOWS\system32>

and this too ...

Code:

PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Corporation UEFI CA 2011'
True
PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Windows Production PCA 2011'
True
PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft UEFI CA 2023'
True
PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
True
PS C:\WINDOWS\system32>

garlin · Sep 16, 2025

Try adding this new line at the beginning of the script:

Code:

$DebugPreference = 'Continue'

AK6DN · Sep 16, 2025

garlin said:
Try adding this new line at the beginning of the script:

Code:

$DebugPreference = 'Continue'

garlin · Sep 16, 2025

I'll DM you a debug script. Send me the results,.

garlin · Sep 16, 2025

@Akeo, can you help us?

@AK6DN updated his UEFI using Mosby, and it's breaking the Get-UefiDatabaseSignatures function as provided by:

Check-UEFISecureBootVariables/Get-UEFIDatabaseSignatures.ps1 at main · cjee21/Check-UEFISecureBootVariables

It's throwing an exception for:

Code:

CN=Microsoft Corporation KEK CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US
CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft Corporation UEFI CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US
CN=MosbyKey [2025.09.15]
Cannot convert value "System.Byte[]" to type "System.Guid". Error: "Byte array for GUID must be exactly 16 bytes long."

I'm not an UEFI expert, just borrowing their function to extract the cert names (instead of using dodgy string or byte matches on the binary data). This is the first error of this type anyone's encountered with my script. I was wondering if there's a mismatch between Mosby and what those folks are expecting.

Here's a copy of my script for reference.

RJARRRPCGP · Sep 16, 2025

garlin said:
@Akeo, can you help us?

@AK6DN updated his UEFI using Mosby, and it's breaking the Get-UefiDatabaseSignatures function as provided by:

Check-UEFISecureBootVariables/Get-UEFIDatabaseSignatures.ps1 at main · cjee21/Check-UEFISecureBootVariables

It's throwing an exception for:

Code:

CN=Microsoft Corporation KEK CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US CN=Microsoft Corporation UEFI CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US CN=MosbyKey [2025.09.15] Cannot convert value "System.Byte[]" to type "System.Guid". Error: "Byte array for GUID must be exactly 16 bytes long."

I'm not an UEFI expert, just borrowing their function to extract the cert names (instead of using dodgy string or byte matches on the binary data). This is the first error of this type anyone's encountered with my script. I was wondering if there's a mismatch between Mosby and what those folks are expecting.

Here's a copy of my script for reference.

Do you think it's a corruption?

garlin · Sep 16, 2025

I have no idea, you might have two different interpretations of the same thing.

I'm borrowing a code function written by folks with more UEFI knowledge than myself (none). While you can do a simple string match like MS does, returning a structured data object of the certs list is a higher form of sanity checking. Which is a good thing to have.

AK6DN · Sep 16, 2025

RJARRRPCGP said:
Do you think it's a corruption?

My suspicion is that the Mosby tool which I used to update the KEK/DB certificates to 2023 and insert private platform certificate files
is generating the private platform certificates (the MosbyKey) in a way which the script used here does not understand. Who is at fault (if any) is yet TBD.

I do not experience any misbehavior of my system so far. More info and/or debugging is required to determine the root cause and a fix if any.

RJARRRPCGP · Sep 16, 2025

AK6DN said:
My suspicion is that the Mosby tool which I used to update the KEK/DB certificates to 2023 and insert private platform certificate files
is generating the private platform certificates (the MosbyKey) in a way which the script used here does not understand. Who is at fault (if any) is yet TBD.

I do not experience any misbehavior of my system so far. More info and/or debugging is required to determine the root cause and a fix if any.

I just hope this isn't the sign of someone tampering with code again. Like what reportedly happened on September 8, 2025.

AK6DN · Sep 16, 2025

RJARRRPCGP said:
I just hope this isn't the sign of someone tampering with code again. Like what reportedly happened on September 8, 2025.

IDK I used Mosby v2.3 release from Jun 11 2025. Everything works fine on my system, it is the Check_EFIBootFile.ps1 script that is misbehaving.

Did you manually update your Secure Boot Keys ?

Peaceful Citizen

My Computers

Peaceful Citizen

My Computers

Semper paratus

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Similar threads