Did you manually update your Secure Boot Keys ?

gunrunnerjohn said:

You are correct, I had to use the Microsoft instructions to actually install the 2023 keys in the EFI boot partition. I did that and then ran the check... Pretty sure all my machines are booting using the 2023 keys. If they weren't, secure boot would be crashing since the Windows 2011 key is already in the DBX database.

Really, I just want to get the option certificate installed and add the 2011 option certificate to the DBX database.

View attachment 146579

Click to expand...

Almighty1 said:

I didn't mean the keys as those were handled by Mosby 100% for me except for the Microsoft option ROM which I added on my own directly in the BIOS using the .bin file thanks to @Akeo providing the instructions.

but I was talking about these two things in the mitigation section from How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support



which is basically the \efi\microsoft\boot\bootmgfw.efi file.

and this is the SVN:

Click to expand...

gunrunnerjohn said:

If I hadn't updated the boot manager on my machine, I wouldn't be typing this since secure boot is enabled and the 2011 Windows key has been revoked!

Click to expand...

gunrunnerjohn said:

I just want to get the 2011 Windows cert revoked, I just missed the -x when I did my reading. However, since the option cert is going to be added to Mosby, hopefully that will do both in the same run.

Click to expand...

Almighty1 said:

not the Microsoft Corporation UEFI CA 2011

Click to expand...

garlin said:

Not yet, because you guys keep jumping faster than I can do reasonable testing.
Remember, this thread started with "How do we do the update by following MS's exact instructions?".

But you can scroll down this block:

Code:

    $KEK_Certs = @((Get-SecureBootUEFI KEK | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
    $db_Certs  = @((Get-SecureBootUEFI db  | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
    $dbx_Certs = @((Get-SecureBootUEFI dbx | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })

And replace those lines with:

Code:

    $KEK_Certs = @((Get-SecureBootUEFI KEK | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft|Mosby' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
    $db_Certs  = @((Get-SecureBootUEFI db  | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft|Mosby' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
    $dbx_Certs = @((Get-SecureBootUEFI dbx | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft|Mosby' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })

Click to expand...

Almighty1 said:

When I read the README originally, my impression was running as Mosby installed the 3 keys but running Mosby -x only did the DBX part and not the key installing.

Click to expand...

Installing SSPV: 'SkuSiPolicyVersion [2023.04.29]'
Installing SSPU: 'SkuSiPolicyUpdateSigners [2023.04.29]'
Installing SBAT: 'SbatLevel.txt [2024.01.09]'
Installing DBX:  'Revocation of 'Microsoft Windows Production PCA 2011''
Installing DBX:  'Microsoft's 'Secure Version Number' DBX entries [2025.01]'
Installing DBX:  'DBX for x86 (64 bit) [2025.06.11]'
Installing DB:   'Windows UEFI CA 2023'
Installing DB:   'Microsoft Corporation UEFI CA 2011'
Installing DB:   'Microsoft UEFI CA 2023'
Installing DB:   From 'MosbyKey.crt'
Installing KEK:  'Microsoft Corporation KEK CA 2011'
Installing KEK:  'Microsoft Corporation KEK 2K CA 2023'
Installing PK:   'Mosby Generated PK [2025.09.25]'

Akeo said:

Unlike PCA 2011, Microsoft UEFI CA 2011 has NOT been revoked.

PCA 2011, which is what Microsoft uses to sign their Windows bootloaders, and pretty much nothing else, was revoked as a shorthand to revoke ALL Windows bootloaders that are vulnerable to BlackLotus. Microsoft UEFI CA 2011, which is used to sign the Linux Shim, and a bunch of other stuff (including 2 bootloaders that I publish: UEFI:NTFS and uefi-md5sum, which I very much want to work on Secure Boot systems) has not been revoked.

Therefore is should NOT be in any DBX, and wanting to add it there means you don't understand how these certificates are being used in the context of Secure Boot.

Click to expand...

Akeo said:

Unlike PCA 2011, Microsoft UEFI CA 2011 has NOT been revoked.

PCA 2011, which is what Microsoft uses to sign their Windows bootloaders, and pretty much nothing else, was revoked as a shorthand to revoke ALL Windows bootloaders that are vulnerable to BlackLotus. Microsoft UEFI CA 2011, which is used to sign the Linux Shim, and a bunch of other stuff (including 2 bootloaders that I publish: UEFI:NTFS and uefi-md5sum, which I very much want to work on Secure Boot systems) has not been revoked.

Therefore is should NOT be in any DBX, and wanting to add it there means you don't understand how these certificates are being used in the context of Secure Boot.

Click to expand...

Akeo said:

You are incorrect. Please double check what you are saying before trying to speak authoratively, because you are 100% wrong here, and I'm growing tired of having to correct misconception and approximations in this thread.

This is the actual output from running Mosby -x, which shows that you are incorrect:

Code:

Installing SSPV: 'SkuSiPolicyVersion [2023.04.29]'
Installing SSPU: 'SkuSiPolicyUpdateSigners [2023.04.29]'
Installing SBAT: 'SbatLevel.txt [2024.01.09]'
Installing DBX:  'Revocation of 'Microsoft Windows Production PCA 2011''
Installing DBX:  'Microsoft's 'Secure Version Number' DBX entries [2025.01]'
Installing DBX:  'DBX for x86 (64 bit) [2025.06.11]'
Installing DB:   'Windows UEFI CA 2023'
Installing DB:   'Microsoft Corporation UEFI CA 2011'
Installing DB:   'Microsoft UEFI CA 2023'
Installing DB:   From 'MosbyKey.crt'
Installing KEK:  'Microsoft Corporation KEK CA 2011'
Installing KEK:  'Microsoft Corporation KEK 2K CA 2023'
Installing PK:   'Mosby Generated PK [2025.09.25]'

Click to expand...

gunrunnerjohn said:

I hope you can see why this whole topic is a bit confusing!

Click to expand...

gunrunnerjohn said:

Very true! OK, so we don't want to revoke the Microsoft UEFI CA 2011, obviously good to know! I realized that it wasn't used to boot Windows, but since they had a new 2023 version of the certificate, I falsely assumed that it was included in the certificates to be revoked.

Is the 2023 version just intended to be used going forward, or is there another reason for that to exist.

I guess really my upgrades are complete if the Microsoft UEFI CA 2011 certificate is still a trusted entity.

I hope you can see why this whole topic is a bit confusing!

Click to expand...

Almighty1 said:

You would know Mosby better than anyone else as you are the author but this is what it says on the README and this is a screenshot:

View attachment 146592

The -x says it only install the Microsoft update that invalidates Microsoft Windows Production PCA 2011 which would imply that the only thing it does and not in addition to what running "Mosby" does.

Click to expand...

Akeo said:

I'm going to be very honest here: The only reason this topic is confusing is because you guys are rushing into trying stuff pretty much at random, rather than trying to understand the pieces first.

This is the problem of user forums like this. There's a lot of intrinsic "I was first to do X" competition, for illusory internet bragging right, which leads to approximations, half-truths or flat out errors, along with the usual "Well I was incorrect... but not really" replies, which of course makes a thread where people want to find actual actionable data a complete mess to sieve through.

Click to expand...

• -x: Install the Microsoft update that invalidates Microsoft Windows Production PCA 2011. You should only use this if you know what you are doing, as you you may not be able to boot or reinstall Windows otherwise. You have been warned!

Almighty1 said:

as you said -x revoked the 2011 ROM in a earlier post

Click to expand...

Akeo said:

Please re-read what the README actually says. There's an "only" there, but NOT for the certificate that is going to be installed part. Instead it is for the "You are supposed to know what you are doing part". See also my previous reply.

Click to expand...

Almighty1 said:

I don't need to

Click to expand...

Akeo said:

Point to that post then.

Click to expand...