Did you manually update your Secure Boot Keys ?

antspants · Sep 21, 2025

starchase said:
"All you do is . . . . " Well, yeah. Mosby's instruction for Rufus is to click the arrow that's to the right of "Select" - but there is no down arrow. Copilot agreed with me that it wasn't there and made a suggestion that seemed incorrect for the most recent Rufus I was using. So, sorry to prolong the agony but I'll politely pass on all that work.

Is this your laptop?

Did you update the BIOS in August? There is a BIOS on the support page for August 25th (F.30 Rev.A) but it doesn’t say what’s in it. At a guess, you need it.
Make sure this IS your laptop (Should be exact model underneath)

HP Spectre x360 13.5 inch 2-in-1 Laptop PC 14-ef0000

^ IS where HP keeps diverting me?

antspants · Sep 21, 2025

It keeps diverting me to the above page when I enter your Model from your specs but I am not certain it’s yours.

Can you go here and enter what it wants, look for a recent BIOS update?

https://support.hp.com/sk-en/product/details/hp-spectre-x360-convertible-pc-series/model/10477220

Or download HP Support Assist 9 and let it check for updates. You can remove it later if you like.

Almighty1 · Sep 21, 2025

starchase said:
"All you do is . . . . " Well, yeah. Mosby's instruction for Rufus is to click the arrow that's to the right of "Select" - but there is no down arrow. Copilot agreed with me that it wasn't there and made a suggestion that seemed incorrect for the most recent Rufus I was using. So, sorry to prolong the agony but I'll politely pass on all that work.

The problem is bad instructions for Rufus itself as getting that menu is where the problem lies.... I will do it manually now as this is the 2nd time I have used Rufus even though I have downloaded it for the last 10+ years:
1) Open Rufus
2) on the top right, click on the arrow next to the word "SELECT" which is what you are referring to and the arrow is there (If you are not seeing the arrow - please see Did you manually update your Secure Boot Keys ? on why it is not showing and how to fix it so it shows):

3) in that arrow dropdown, choose DOWNLOAD

4) the word in the box will now change to DOWNLOAD

5) Click on the word DOWNLOAD

6) A Download ISO Image box will come up

7) Choose the latest UEFI Shell which is v2.2 at this time

8) Click Continue

9) A Release box will come up:

10) Choose the newest Release which is the 25H1 entry:

11) Click on Continue

12) An Edition option will come up, choose Release and then continue
13) An Language option will come up, where English (US) is the only choice, so Continue again
14) There will be a Architecture box that comes up which there is only one choice, so Continue again

15) Click the Download button at the bottom and it will asked where to save file and download
16) once you get back to the main screen, click on the Start button on the bottom

I am on another machine but basically you need a USB Flash Drive already in the system before you do all this.

When I did this, I read the following post and the things after that:

Act now: Secure Boot certificates expire in June 2026

UPDATE: https://www.elevenforum.com/t/updating-microsoft-secure-boot-keys-before-expiration-in-june-2026.22477/ Windows IT Pro Blog: Prepare for the first global large-scale certificate update to Secure Boot. The Microsoft certificates used in Secure Boot are the basis of trust for operating...

www.elevenforum.com

gunrunnerjohn · Sep 21, 2025

I've already invalidated the Windows 2011 certificate, but I haven't invalidated the Microsoft one.

Almighty1 · Sep 21, 2025

gunrunnerjohn said:
I've already invalidated the Windows 2011 certificate, but I haven't invalidated the Microsoft one.

I thought they were one and the same as I think these are the only ones:

starchase · Sep 21, 2025

No, but thanks for searching. My laptop is 13-4001dx. Product # L0Q55UA#ABA. My HP Support Assistant doesn't show any updates available for this machine at all. I even went on the HP support page for my machine (the link in this post) and it either doesn't show anything or fails to send me to the page to tell me these is anything! Right now the most recent BIOS this machine received is F.54 dated 12/27/2019. The machine does have a TPM made by IFX but it's 1.2.

Thanks for checking

gunrunnerjohn · Sep 21, 2025

Almighty1 said:
I thought they were one and the same as I think these are the only ones:
View attachment 146152

There are two certificates, I've never seen the Windows 2010 one.

I want to revoke the one with the yellow arrow, as you can see, the Windows one is already been revoked and entered into the DBX database.

starchase · Sep 21, 2025

Almighty1 said:
The problem is bad instructions for Rufus itself as getting that menu is where the problem lies.... I will do it manually now as this is the 2nd time I have used Rufus even though I have downloaded it for the last 10+ years:
1) Open Rufus
2) on the top right, click on the arrow next to the word "SELECT" which is what you are referring to and the arrow is there:
View attachment 146140

3) in that arrow dropdown, choose DOWNLOAD

Here is what the Rufus shows - I just downloaded it.

Cy_kkm · Sep 21, 2025

bikemanAMD said:
should i do the instructions on my rarely logged into "Adminstrator user login" or can i do them on my Microsoft Account linked Standard account.

As long as you run PowerShell elevated ("Run as Administrator"), doesn't matter. If neither command returns access denied or something like that, it's alright. The system doesn't care who made the registry change and started the update task.

Having said that, stick to the best security practices:

Disable the Administrator account. If you want a backup account in case you're locked out, keep the Administrator enabled but rename it. Make sure remote logon is disabled for this account: most attacks are executed remotely.
Don't use passwords for logon. Windows Hello biometrics is available with Logitech BRIO USB camera for a desktop; most notebooks have an embedded Hello-compatible camera already. Maybe there are other cams supporting Hello, I found none, and BRIO is very good as a normal, optical camera — 4K, three different focal lengths (viewing angle), and a good mic. (Side column: when COVID started, I went shopping for a camera, to discover, to my utter surprise, that I'm not alone... These went $700 on average vs. MSRP $125 or so; now $170, of course — what goes up comes down, except prices. I found the last one from one Amazon seller for $420 and considered myself lucky. Oh, what a time that was!) Another option is a USB fingerprint scanner, cannot recommend any, never tested or used on desktop. Make sure it has liveness detection. A $10 reader from a far-away big friendly panda country certainly doesn't. If unable, set up a PIN, but leave password alone, for gossake! Passwords get stolen or forgotten, but you can't lose your face — in the literal sense only, of course.
Prefer browser-stored token login to password login to Microsoft Account on the Web (and any account, basically). You need Windows Hello set up for the browser to release your token, so only you can logon with that Web token
If not logging in with an MS account, you may still connect it in Connect Accounts and use for BitLocker unlock code backup.
Provided that you've protected it with 2FA and the Authenticator app on your phone. MS authenticator is integrated with MS logon to any of their sites, Google Authenticator may be integrated with your Google account (or many accounts, up to a reasonable number, like 5). Otherwise, both app provide TOTP tokens (the 6-digit codes changing every minute) for 2FA with 3rd party logins.
And always save emergency codes when enabling 2FA, or, if you lose your phone, or if it dies, you're locked out of all 2FA accounts.
All major password managers are safe, as long as you can log in on the web with a webtoken or unlock it locally with Hello. Another good place for saving arbitrary short secrets. Encode tiny binary secret files with base64 to store them as text (you'll find even an explorer context menu extension, this encoding is just everywhere).
If keeping the BitLocker unlock code outside the account, print and store in a safe place. Keeping it with a family member living separately who can recognise your voice and read it to you is the safest of free options. A much better one is a FIPS-140.2 certified USB stick with a keypad. I've been using Aegis 3NX/3NXC by Apricorn, Inc. Any will work, but verify the FIPS-140.2 level 3 certification in the public NIST database, don't trust the not by asking the seller. Some use fingerprint to unlock, that's fine, but register more than one finger; otherwise if you cut the finger, you'll be locked out for two weeks — in the best case, i.e. that which would leave no scar… And please, please read the manual before use. Then you can store text files with unlock code and .BEK keys (read the bde-manage command manual if you didn't create both while first enabling BitLocker, or need to rekey, etc) — if a .BEK file is found in the root of any removable drive, BitLocker looks for them and unlocks if it finds a match. 4GB is more than enough to keep a bootable environment to restore your backup (you do backup your system on schedule, right? RIGHT???) and all the secrets — they are small. Chose the drive that has an option to disable lock up on USB bus reset, otherwise booting from it becomes an exercise in inserting the drive at the exactly right second. I forgot, did I mention reading the drive manual? You need only the administrator's account, no user account, and recovery pins is your call. I don't use them.
But do you image your system on a schedule or not? Contrary to what MS pushes you to believe if you have a MSO365 sub, OneDrive is not a backup: only immutable copies qualify. Backups should solve not only disk failures, which are rare now, but also, if not mainly, fat-finger accidents, installs of good software gone bad, installs of bad software, installs of software that, let's put it, doesn't want you to know that it has installed itself, etc. Mirroring your exact state to OneDrive won't save you from any of the above: a file deleted here is deleted everywhere, including the cloud. This marketing is extremely irresponsible, don't buy into it. There's unfortunately no hack to disable it, but it gives up in a couple of months of pushing it in your face from every program if you ignore it. They just want to sell more of OneDrive to you.
If not logging in with an MS account, create a password reset "disk". Use the same FIPS drive, creating the reset "disk" just writes one small file to the root of the drive (doesn't format the disk). If keeping multiple accounts or machines, move the file immediately to the \Password-recovery-files\<machine name>\<user-name>\ directory, the file must have the exact name to work. To recover, move the file to the root of the drive, delete after resetting the password. Re-enroll Hello immediately after password reset, delete old file, and create the new "reset disk".
Having done that, you may safely disable the Administrator account. One password less, attack surface shrinks.
Keep Secure Boot on at all times. The current certificate turmoil will lead to tens to hundreds of millions of users simply turning off Secure Boot. I'm not the only one who can figure that out: some smart but criminal people are working full steam on UEFI rootkits right at this very moment. The Dark Web is a vast marketplace. BlackLotus was purchased for $5,000 on Dark Web from the developer, as the bitcoin chains show — a ridiculous amount compared to the inflicted damage.

bikemanAMD · Sep 21, 2025

Cy_kkm said:
As long as you run PowerShell elevated ("Run as Administrator"), doesn't matter. If neither command returns access denied or something like that, it's alright. The system doesn't care who made the registry change and started the update task.

Having said that, stick to the best security practices:

Disable the Administrator account. If you want a backup account in case you're locked out, keep the Administrator enabled but rename it. Make sure remote logon is disabled for this account: most attacks are executed remotely.

Don't use passwords for logon. Windows Hello biometrics is available with Logitech BRIO USB camera for a desktop; most notebooks have an embedded Hello-compatible camera already. Maybe there are other cams supporting Hello, I found none, and BRIO is very good as a normal, optical camera — 4K, three different focal lengths (viewing angle), and a good mic. (Side column: when COVID started, I went shopping for a camera, to discover, to my utter surprise, that I'm not alone... These went $700 on average vs. MSRP $125 or so; now $170, of course — what goes up comes down, except prices. I found the last one from one Amazon seller for $420 and considered myself lucky. Oh, what a time that was!) Another option is a USB fingerprint scanner, cannot recommend any, never tested or used on desktop. Make sure it has liveness detection. A $10 reader from a far-away big friendly panda country certainly doesn't. If unable, set up a PIN, but leave password alone, for gossake! Passwords get stolen or forgotten, but you can't lose your face — in the literal sense only, of course.

Prefer browser-stored token login to password login to Microsoft Account on the Web (and any account, basically). You need Windows Hello set up for the browser to release your token, so only you can logon with that Web token

If not logging in with an MS account, you may still connect it in Connect Accounts and use for BitLocker unlock code backup.

Provided that you've protected it with 2FA and the Authenticator app on your phone. MS authenticator is integrated with MS logon to any of their sites, Google Authenticator may be integrated with your Google account (or many accounts, up to a reasonable number, like 5). Otherwise, both app provide TOTP tokens (the 6-digit codes changing every minute) for 2FA with 3rd party logins.

And always save emergency codes when enabling 2FA, or, if you lose your phone, or if it dies, you're locked out of all 2FA accounts.

All major password managers are safe, as long as you can log in on the web with a webtoken or unlock it locally with Hello. Another good place for saving arbitrary short secrets. Encode tiny binary secret files with base64 to store them as text (you'll find even an explorer context menu extension, this encoding is just everywhere).

If keeping the BitLocker unlock code outside the account, print and store in a safe place. Keeping it with a family member living separately who can recognise your voice and read it to you is the safest of free options. A much better one is a FIPS-140.2 certified USB stick with a keypad. I've been using Aegis 3NX/3NXC by Apricorn, Inc. Any will work, but verify the FIPS-140.2 level 3 certification in the public NIST database, don't trust the not by asking the seller. Some use fingerprint to unlock, that's fine, but register more than one finger; otherwise if you cut the finger, you'll be locked out for two weeks — in the best case, i.e. that which would leave no scar… And please, please read the manual before use. Then you can store text files with unlock code and .BEK keys (read the bde-manage command manual if you didn't create both while first enabling BitLocker, or need to rekey, etc) — if a .BEK file is found in the root of any removable drive, BitLocker looks for them and unlocks if it finds a match. 4GB is more than enough to keep a bootable environment to restore your backup (you do backup your system on schedule, right? RIGHT???) and all the secrets — they are small. Chose the drive that has an option to disable lock up on USB bus reset, otherwise booting from it becomes an exercise in inserting the drive at the exactly right second. I forgot, did I mention reading the drive manual? You need only the administrator's account, no user account, and recovery pins is your call. I don't use them.

But do you image your system on a schedule or not? Contrary to what MS pushes you to believe if you have a MSO365 sub, OneDrive is not a backup: only immutable copies qualify. Backups should solve not only disk failures, which are rare now, but also, if not mainly, fat-finger accidents, installs of good software gone bad, installs of bad software, installs of software that, let's put it, doesn't want you to know that it has installed itself, etc. Mirroring your exact state to OneDrive won't save you from any of the above: a file deleted here is deleted everywhere, including the cloud. This marketing is extremely irresponsible, don't buy into it. There's unfortunately no hack to disable it, but it gives up in a couple of months of pushing it in your face from every program if you ignore it. They just want to sell more of OneDrive to you.

If not logging in with an MS account, create a password reset "disk". Use the same FIPS drive, creating the reset "disk" just writes one small file to the root of the drive (doesn't format the disk). If keeping multiple accounts or machines, move the file immediately to the \Password-recovery-files\<machine name>\<user-name>\ directory, the file must have the exact name to work. To recover, move the file to the root of the drive, delete after resetting the password. Re-enroll Hello immediately after password reset, delete old file, and create the new "reset disk".

Having done that, you may safely disable the Administrator account. One password less, attack surface shrinks.

Keep Secure Boot on at all times. The current certificate turmoil will lead to tens to hundreds of millions of users simply turning off Secure Boot. I'm not the only one who can figure that out: some smart but criminal people are working full steam on UEFI rootkits right at this very moment. The Dark Web is a vast marketplace. BlackLotus was purchased for $5,000 on Dark Web from the developer, as the bitcoin chains show — a ridiculous amount compared to the inflicted damage.

I typically follow as much best practices i can, Main System account is local, named PC Admin that i do my Admin tasks on at times, will have to see if Remote Desktop is disabled on that one or not--((Rarely login to the Local Account, except for Admin tasks)

Accounts setup same way on both of my most used systems
Desktop & Gaming Laptop

**Remote Assistance unchecked on that account & Remote Desktop set for Don't allow Remote Connections** Actually set same for both accounts on system currently.

Roboform Password manager paid up til 2027 or 2029, can't remember exactly how long i renewed it for lol

System image backup done every Sunday morning, on 2 Drives, 1st drive stored up here under TV Stand, 2nd Drive stored in Basement secondary TV stand behind a glass door, unforuately its all i got, as don't drive, and no where close to store one of them off site.

Will look to invest in Logitech Brio webcam for Windows Hello feature

Standard account uses MS Account--Remote Desktop only enabled when i feel i'll need it, otherwise most of the time off

Secure Boot is on at all times, i never ever turn it off, as typically i don't use flash drive boot drives all that often, and eventually once all the certificates are updated for Secure Boot all the USB drives will boot just fine again to use when needed in the future.

Do not use Bitlocker

All Updates are installed immediately when released for Windows, MS Office 365, and every other Program on System, update checks done a bit each day

Think im good, will get a Logitech Brio cam as soon as i can

Cy_kkm · Sep 21, 2025

antspants said:
Is this your laptop?

HP Spectre x360 13.5 inch 2-in-1 Laptop PC 14-ef0000

^ IS where HP keeps diverting me?

The whole HP updates site is one huge shovelup at the moment (the moment continues for the third week in a row; the support on the support message board replies to every question except questions about BIOS or certificate updates). My model code is 39R24AV, blah-blah-16-f0000, and I have installed firmware version F.21A of 2024-03-27. The site offers F23.A from May, and F21.A, but not with my date. I tried both, and neither installs on my HP notebook: "this model is not compatible with this update". Now, have Google Translate ready, as the site randomly switches from any language to Indonesian when following any link. Every update has an update history, and you'd think that update histories of F23.A and that of F21.A should be same all the way up to including F20.A, and you expect to see the same F21.A as a earlier release of the same firmware. Nope, they have different past each. Look at the update histories back in time from F23.A, and from F21.A (opening link to each update in a new tab will save you a lot of time, 'cuz it'll send you to the lookup box upon any browser's go-back, but that "feature" has always been there).

Pay attention to file sizes, not only dates. They vary between 10MB and 18MB, and not like it was growing from version to version. Some are 10±1MB, some are exactly 18MB.

In the history of the initial F23.A, there are F22.A and another F21.A, with the third date. Neither installs on my machine with the same diagnostic.

Next, check F22.A (it also doesn't install) in the history of the F23.A. There are a few different versions, including another F21.A (again, none of these versions F21.A have my date or install on my machine).

Back from F21.A, a few consistently sized versions are shown, but I didn't risk trying F20.A and below, thus downgrading — I won't be able to get my current F21.A back...

I don't believe I'll get the FW update from HP, so my notebook will turn into a pumpkin in June. And my desktop has a video card, an NVIDIA licensed RTX3070Ti from Palit. They also don't reply to questions, and every discrete video card has a UEFI-mode video GOP driver, which displays the initial screen and BIOS setup screens. It's also must be signed, and is signed with the '2011 certificate, and is not even initialised if signature doesn't validate (in the Secure Boot mode only). So my desktop turns into a pumpkin in June, too. That's expected, as NVIDIA has a legal obligation to its shareholder to increase the share value, but no obligations to me after 1 year of warranty expires. They will lose sales if everybody updates their VBIOSes, so no updates to anyone after warranty — not only the non-update brings the company more sales, but is even illegal w.r.t. shareholders, strictly speaking. They'd have no option even if Jenson were an angel, not a business shark. Shareholders will sue him if they don't let our practically new video cards (older than one year) break. And they're not responsible, Microsoft is, really.

The class action against Microsoft is going to be perhaps the largest one in history, no kidding. It's not like if you bought this soap in Costco between these dates. Almost every desktop breaks (NVIDIA has how much, 90% of the video card market? And people upgrade their GPUs not so often, they cost a fortune), and notebooks past warranty are at the mercy of OEMs (MS has a lot of incentive to reduce damages and the eternal infamy by squeezing the updates out of OEMs, and they can, so there is still some hope for notebooks). It's the GPUs that are nearly the world-ending event.

I'm looking — conservatively — at about $12,000-$15,000 for me and wife (3 computers in total, two nearly new, just out of warranty) in replacement hardware, but the price of GPUs closer to Day X is unpredictable, a mid-range new (i.e., correctly signed) one may become more expensive than a small car. (Don't even think of buying a used one, being able to return under warranty is mandatory.) And who knows if I'll even be able to get a new notebook... It took me a year to buy that GPU card, between "out of stock" and "in stock, $1,800" for RTX3070Ti. I think they dropped a bit then the RTX5000 series came out, so I got one at a sensible price. If just under $1,000 for a video card is "sensible".

antspants · Sep 21, 2025

Cy_kkm said:
The whole HP updates site is one huge shovelup at the moment

I’d suggest you download HP Support Assist 9 and let it search, then update for you.

HP Support Assistant | HP® Support

For automated fixes, personalized support, and automatic updates, try HP Support Assistant today.

support.hp.com

Almighty1 · Sep 21, 2025

gunrunnerjohn said:
There are two certificates, I've never seen the Windows 2010 one.

I want to revoke the one with the yellow arrow, as you can see, the Windows one is already been revoked and entered into the DBX database.

View attachment 146153

I am not even sure where the 2010 came from as when I did a Delete all Keys and Reset all keys so it loads the defaults and then did Mosby, my DBX is blank. Maybe it was when 2010 certificates still existed in the DB before the 2011 certificates came out? As I have been doing these certificates thing since 2024.

Microsoft's instructions appears to only add "Microsoft Windows Production PCA 2011" to the DBX as seen below:

It seems logical that both 2011's should be in DBX but somehow all articles and everyone's sceeenshots only cover the PCA and not the UEFI for 2011 in the DBX. So not sure if DBX on the 2011 UEFI is needed or not.

antspants · Sep 21, 2025

Cy_kkm said:
The whole HP updates site is one huge shovelup at the moment (the moment continues for the third week in a row; the support on the support message board replies to every question except questions about BIOS or certificate updates). My model code is 39R24AV, blah-blah-16-f0000, and I have installed firmware version F.21A of 2024-03-27. The site offers F23.A from May, and F21.A, but not with my date. I tried both, and neither installs on my HP notebook: "this model is not compatible with this update". Now, have Google Translate ready, as the site randomly switches from any language to Indonesian when following any link. Every update has an update history, and you'd think that update histories of F23.A and that of F21.A should be same all the way up to including F20.A, and you expect to see the same F21.A as a earlier release of the same firmware. Nope, they have different past each. Look at the update histories back in time from F23.A, and from F21.A (opening link to each update in a new tab will save you a lot of time, 'cuz it'll send you to the lookup box upon any browser's go-back, but that "feature" has always been there).

Pay attention to file sizes, not only dates. They vary between 10MB and 18MB, and not like it was growing from version to version. Some are 10±1MB, some are exactly 18MB.

In the history of the initial F23.A, there are F22.A and another F21.A, with the third date. Neither installs on my machine with the same diagnostic.

Next, check F22.A (it also doesn't install) in the history of the F23.A. There are a few different versions, including another F21.A (again, none of these versions F21.A have my date or install on my machine).

Back from F21.A, a few consistently sized versions are shown, but I didn't risk trying F20.A and below, thus downgrading — I won't be able to get my current F21.A back...

I don't believe I'll get the FW update from HP, so my notebook will turn into a pumpkin in June. And my desktop has a video card, an NVIDIA licensed RTX3070Ti from Palit. They also don't reply to questions, and every discrete video card has a UEFI-mode video GOP driver, which displays the initial screen and BIOS setup screens. It's also must be signed, and is signed with the '2011 certificate, and is not even initialised if signature doesn't validate (in the Secure Boot mode only). So my desktop turns into a pumpkin in June, too. That's expected, as NVIDIA has a legal obligation to its shareholder to increase the share value, but no obligations to me after 1 year of warranty expires. They will lose sales if everybody updates their VBIOSes, so no updates to anyone after warranty — not only the non-update brings the company more sales, but is even illegal w.r.t. shareholders, strictly speaking. They'd have no option even if Jenson were an angel, not a business shark. Shareholders will sue him if they don't let our practically new video cards (older than one year) break. And they're not responsible, Microsoft is, really.

The class action against Microsoft is going to be perhaps the largest one in history, no kidding. It's not like if you bought this soap in Costco between these dates. Almost every desktop breaks (NVIDIA has how much, 90% of the video card market? And people upgrade their GPUs not so often, they cost a fortune), and notebooks past warranty are at the mercy of OEMs (MS has a lot of incentive to reduce damages and the eternal infamy by squeezing the updates out of OEMs, and they can, so there is still some hope for notebooks). It's the GPUs that are nearly the world-ending event.

I'm looking — conservatively — at about $12,000-$15,000 for me and wife (3 computers in total, two nearly new, just out of warranty) in replacement hardware, but the price of GPUs closer to Day X is unpredictable, a mid-range new (i.e., correctly signed) one may become more expensive than a small car. (Don't even think of buying a used one, being able to return under warranty is mandatory.) And who knows if I'll even be able to get a new notebook... It took me a year to buy that GPU card, between "out of stock" and "in stock, $1,800" for RTX3070Ti. I think they dropped a bit then the RTX5000 series came out, so I got one at a sensible price. If just under $1,000 for a video card is "sensible".

As for the rest, I got lost in your post, but I think you’re asking the following?

Why are HP firmware versions inconsistent and incompatible with the user’s model?
- Use HP Support Assist 9
Why are OEMs and vendors silent on Secure Boot certificate updates?
- They’re not, if a Motherboard or Laptop is still supported by the vendors, a BIOS update will be supplied.
Is Microsoft responsible for enforcing Secure Boot without providing a fallback?
- They have already, the answer is “Disable Secure Boot”
Will there be legal consequences for the mass expiration of signed firmware?
- Who knows, but I doubt it.
How can consumers protect themselves from forced obsolescence due to expired certificates?
- “Disable Secure Boot”

Cy_kkm · Sep 21, 2025

antspants said:
I’d suggest you download HP Support Assist 9 and let it search, then update for you.

Thank you, didn't think about it! The installation ends with the error code -2, though. Maybe I just need to reboot. I removed it when warranty expired, it collected a ton of data but didn't offer me a single update, so in 6 months I kicked it out...

Do you know what is the "smart friend" service? Maybe I can pay my way out to get the update? They ask for $16.99 a month. Uh, not really, they ask for $16.99⁺ a month, but this asterisk is not explained anywhere. If it means "paid annually" I'm still paying, that's much less than a new notebook. But I have no idea what I can get from that.

antspants · Sep 21, 2025

Cy_kkm said:
Do you know what is the "smart friend" service?

No, sorry I don’t.

But if we eventually get a clear set of instructions from somebody here, that isn’t drowned in a sea of other posts, you should be right to manually change the cert — IF we get a clear post.

Otherwise, as apposed to paying $17.00 a month, I’d pay a Computer tech to sort it for me.

There are some pretty good instructions from Garlin, he has been very generous with his time on this. But they’re buried in a sea of posts. It got very messy and now most confusing.

Almighty1 · Sep 21, 2025

starchase said:
Here is what the Rufus shows - I just downloaded it.
View attachment 146155

Are you using the installed version or the portable version? I am using the later and you are right, the arrow is missing and you should probably start a issue thread for rufus on github or something. Maybe someone else who uses rufus might know more about why it is not showing the arrow next to select.

Can you try this which is what Google's AI says:

Almighty1 · Sep 21, 2025

@starchase - I found the answer for you at FAQ

You need to have Check for updates enabled in Rufus's settings or otherwise the download will be disabled.

starchase · Sep 21, 2025

Thanks Almighty1, I found it now.

gunrunnerjohn · Sep 21, 2025

Almighty1 said:
I am not even sure where the 2010 came from as when I did a Delete all Keys and Reset all keys so it loads the defaults and then did Mosby, my DBX is blank. Maybe it was when 2010 certificates still existed in the DB before the 2011 certificates came out? As I have been doing these certificates thing since 2024.

Microsoft's instructions appears to only add "Microsoft Windows Production PCA 2011" to the DBX as seen below:
View attachment 146162

It seems logical that both 2011's should be in DBX but somehow all articles and everyone's sceeenshots only cover the PCA and not the UEFI for 2011 in the DBX. So not sure if DBX on the 2011 UEFI is needed or not.

Correct, that works just fine to nuke the Windows 2011 certificate. However, leaving the other one enabled seems to offer a security hole, so I'd like to plug that hole. As far as the extra certificate, I'm not going to concern myself with it as I've never seen it mentioned before now. If I deal with the two 2011 certificates and get them revoked and entered into the DBX database, I'll be a happy camper. If I don't have that 3rd certificate, it's hard to see how it can be exploited!

Did you manually update your Secure Boot Keys ?

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Similar threads