Did you manually update your Secure Boot Keys ?

starchase · Sep 26, 2025

Brink said:
Frequently asked questions about the Secure Boot update process - Microsoft Support

support.microsoft.com

I don't read anything in this FAQ about resorting to Secure Boot disabled, so I hope, for those of us who probably will not be able to get all the alternative suggestions in these posts to work, booting without Secure Boot will still permit our older unsupported systems to function.

I don't want to abandon my perfectly good ASUS desktop because of this.

FIREMEDIC2700 · Sep 26, 2025

well its not giving me that

neldog · Sep 26, 2025

FIREMEDIC2700 said:
well since this is the case i wonder if i should keep trying to get mosby to work to install my missing certify

I will have to defer that question to others here with a higher pay grade than I.

Almighty1 · Sep 26, 2025

FIREMEDIC2700 said:
HOLLY GIG . WOW 1 gig of hard drive space i sure hope that does not have to be on and only the first one

1GB of hard drive space is nothing these days as even Nvidia drivers is almost 1GB.

Almighty1 · Sep 26, 2025

FIREMEDIC2700 said:
well its not giving me that

Yes and your Mosby was created correctly or you wouldn't have gotten that far.

FIREMEDIC2700 · Sep 26, 2025

very confusing . i tried so many options maybe i will just wait at least i got the uefi ca 2023 installed and its secure booting without a uefi dbx and the 2023 kek . i dont know what else to try since mosby is not doing nothin g

FIREMEDIC2700 · Sep 26, 2025

also will a clean install wipe these out ?

Scott · Sep 26, 2025

FIREMEDIC2700 said:
also will a clean install wipe these out ?

No. A clean install will load Windows only, it will not affect UEFi or Secure Boot settings.

FIREMEDIC2700 · Sep 26, 2025

thanks

Akeo · Sep 26, 2025

@FIREMEDIC2700, try typing Mosby_x64.efi and see if that works better. If that still doesn't work, try typing FS0:, FS1:, etc and then dir until you see Mosby_x64.efi listed.

The Mosby command on its own tries to invoke a shell script that attempts to locate the arch and location of the actual Mosby_###.efi executable. So if that shell script doesn't work, just invoking the .efi directly should work better.

FIREMEDIC2700 · Sep 26, 2025

well i think i got it figure out. i had to create custom keys in my bios. does this look correct now

FIREMEDIC2700 · Sep 26, 2025

should i be worried that i dont have a uefi dbx cert ?

Yozaemon · Sep 26, 2025

Mosby is the most suitable and safest application for updating Secure Boot keys.
However, its use should be limited to those who cannot rely on Microsoft’s automatic updates.
No matter how safe an application may be, using it always comes with personal responsibility. Unlike Microsoft’s official updates, where you can expect support and accountability, Mosby is a community tool.

Another limitation is that Mosby’s PK cannot be used to sign anything afterwards. Signing events are rare, of course, but in that sense it can never fully replace a legitimate PK.

That’s why I recommend first checking whether your PC is capable of receiving KEK automatic updates from Microsoft. Determining your own PK in Windows can be cumbersome, but with an Ubuntu LiveUSB and the mokutil command, you can easily identify it.

The next step is to compare your PK with the PK signatures listed here. This is where the outcome diverges, since these PKs appear to be the basis of the KEKUpdateCombined.bin updates.

If your PK matches, there is no need to panic—you can simply leave everything to Microsoft’s future updates.

But for the handful of cases like mine, where the PK does not match (TEST PKs, expired PKs, or PKs from discontinued vendors), Mosby may truly be the last hope.

gunrunnerjohn · Sep 26, 2025

Akeo said:
Mosby

Is this really true? I though there were keys generated specifically by Mosby to use for signing during the process.

Yozaemon said:
Another limitation is that Mosby’s PK cannot be used to sign anything afterwards. Signing events are rare, of course, but in that sense it can never fully replace a legitimate PK.

Yozaemon · Sep 26, 2025

Is this really true? I though there were keys generated specifically by Mosby to use for signing during the process.

Sorry for my lack of clarity. Regarding the KEK update, what I said earlier is correct.

gunrunnerjohn · Sep 26, 2025

Yozaemon said:
Sorry for my lack of clarity. Regarding the KEK update, what I said earlier is correct.

I was actually waiting for @Akeo to clarify it as I don't believe that is correct.

andyc56 · Sep 26, 2025

gunrunnerjohn said:
I was actually waiting for @Akeo to clarify it as I don't believe that is correct.

I think he addressed that in an earlier post quoted below.

Akeo said:
Now, there is a small drawback in having a PK that cannot be used by anyone else, as it means that the manufacturer cannot push KEK updates (which is actually something Microsoft is in the process of organising for the 2026 expiration apocalypse, because that's the only way they can get the new MS KEK installed, which they also need alongside the new MS DB certs), but considering that if you are trying to secure your platform, you probably want to be in control of who installs a new KEK, and that Mobsy will install the KEK used by Microsoft (which are really the only ones you really need to have), so not letting ill-defined third parties (when was the last time you checked if your motherboard manufacturer actually took security seriously?) install KEKs is probably a good thing.

Also, you have to understand that the whole point of PK's and KEK's is to let someone who doesn't have physical access to the machine push Secure Boot updates "remotely", whereas Mosby is built on the very principle that you do in fact have physical access to the machine and can always put it in Setup Mode to install whatever keys you need, so there's little point in giving anyone, including yourself, access to a PK when you can just fire up Mosby and install whatever keys you need...

gunrunnerjohn · Sep 26, 2025

andyc56 said:
I think he addressed that in an earlier post quoted below.

There's a difference between updating the KEK keys and signing things like new utilities to be compatible with Secure Boot. The Mosby PK doesn't allow anyone else to update the KEK, but that's not something that should be at issue for some time. Once you have the 2023 certs in place and Secure Boot configured, what's the problem? If you would, for some reason, have an update to the KEK in the future, you use Mosby.

itsme1 · Sep 26, 2025

Almighty1 said:
Interesting they use the same 9350 model number that long. In their laptops, it seems like the model is only used for a few years or something. Feel free to ask questions if you decide to use Mosby since I should be able to guide you through it.

Yes, it's confusing for customers.

Mosby should be fine, and I've reread your posts several times, here, on the Mosby GitHub page, and on Reddit. Normally, I know how to put the Dell BIOS into setup mode for Mosby to work

.
As I already said, I'm waiting to see if Microsoft will update everything with updates, the new Mosby with the Microsoft Option ROM UEFI CA 2023 (I still know how to integrate it into the Dell UEFI with the .bin file via custom mode), and a possible new Dell BIOS.
Also, see how things are progressing with NVIDIA GPUs and the 2023 certificate.

Akeo · Sep 26, 2025

Well, the thing is you have to make a choice.

Either you trust your manufacturer to never play fast and loose with their PK's private key, and don't (potentially be coerced to) give it to anybody with ill-defined intentions, ever, in which case you are fine with keeping a PK that you share with many, many other people (and as a result, that is definitely a juicy target for bad actors to attempt to acquire).

Or you don't trust third parties, especially in light of what has repeatedly happened with supposedly private keys that weren't kept that private by manufacturers, in which case you want a PK that is unique to your platform (since, again, the only point of a having a common PK is to be able to push updates to multiple platforms because you won't have physical access to said platforms), because, with physical access, you will 100% be able to resolve any issue that requires installing new KEKs anyway, so it's not like the lack of the PK's private key will be much of a hindrance.

Now, of course, the first option also grants you the ability to not have to do anything and just wait for someone else to update the Secure Boot databases for you, which of course is certainly an incentive...

But again, I have to discredit the idea that losing the ability for a third party to update the KEKs is a big deal, because, as long as you have physical access to a machine, you can install any KEK you want.

Did you manually update your Secure Boot Keys ?

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Similar threads