Did you manually update your Secure Boot Keys ?

bikemanAMD · Sep 30, 2025

FIREMEDIC2700 said:
hmmm . strange my ca 2011 is not revoked but i still used rufus to make the 25h2 iso to ca 2023 . ! think i got my iso for 25h2 from windows central website.

Microsoft's official Windows 11 version 25H2 RTM ISO media is now available — Download all 38 languages here for x64 or Arm64

The next version of Windows 11 is now generally available, and you can download the official offline ISO media for installation onto your computer directly from Microsoft's servers. All the links can be found here!

www.windowscentral.com

Part 2: Creating Windows 11 installation media that works on platforms where PCA 2011 has been revoked.
This task is a lot easier than the previous one. However it requires the use of Rufus v4.10 or later.

In Rufus, select a Windows 11 25H2 ISO (Note that Windows 11 24H2 ISOs will not work on account that Microsoft screwed up compatibility with Windows UEFI CA 2023 in those images. Only the Windows 11 25H2 ISOs are compatible with a Windows UEFI CA 2023 installation).

Click START and, on the Windows User Experience dialog make sure to check the Use 'Windows CA 2023' signed bootloaders option as well as the Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0 option, as Rufus 4.10 will produce an error otherwise (please note that, contrary to what you might believe, this option will still use TPM and Secure Boot if available as it's simply a "bypass if not present", NOT a "disable if present"), along with any other installer customisation option you wish to enable.

Let Rufus create the media and boot it on the target platform. Because Rufus ensured that the UEFI bootloaders on your media are the Windows UEFI CA 2023 signed ones, instead of the PCA 2011, you will then be able to proceed to a full installation of Windows without having to disable Secure Boot.

Ok i will give these steps a try first thing in morning to create my updated Windows 11 25H2 USB boot drive. As right now kinda dark in room, even with the Lamp on and every RGB light i got available, still can't see the rear system ports that well lol
(Currently searching for new batteries for dead flashlight lol--so far no luck in finding any thus far lol))--Found the batteries, i can see a bit again lol

But in Morning i'll get it done for sure

andyc56 · Sep 30, 2025

FIREMEDIC2700 said:
margarita try that link i posted thats where i downloaded the iso from and it seemed to work . let me try it again and see what happens. but i had checked all the boxes not sure if that would make a diff.

I just downloaded the ISO from the main Microsoft Windows 11 download site, which says it's version 25h2. The one I got was by scrolling to the bottom of the page where it says "Download Windows 11 Disk Image (ISO) for x64 devices". It downloaded an ISO directly, rather than using the Media Creation Tool, which I think is a good sign. I burned a bootable USB stick with Rufus 4.10 and the "Windows 2023 CA signed bootloader" option. I tried booting from it using a machine that has the latest certificates in the DB, and the 2011 certificate revoked using the DBx, and it booted into the setup program just fine.

Margarita · Sep 30, 2025

Well, the test was performed on my device by replacing the updated bootx64.efi file, and it was successful.

I will try to test the continuity of the full installation, but on the virtual machine
On the my device, without replacing the updated file, the result attempt to boot forever

Margarita · Sep 30, 2025

FIREMEDIC2700 said:
margarita try that link i posted thats where i downloaded the iso from and it seemed to work . let me try it again and see what happens. but i had checked all the boxes not sure if that would make a diff.

It seems to be the same ISO. Can you test the hash?

Margarita · Sep 30, 2025

andyc56 said:
and it booted into the setup program just fine.

It seems that Rufus is only updating bootx64.efi file.

andyc56 · Sep 30, 2025

Margarita said:
It seems to be the same ISO. Can you test the hash?

View attachment 147288

Same here with the one downloaded from the MS site I linked above.

XxXxX · Sep 30, 2025

i have just finished burning 3x Win 11 25H2 bootable USB sticks with Rufus 4.10.2279
with the now added boot from 2023 cert. if the 2023 cert is installed in secure boot the USB will boot/load and install. if the 2023 cert is not installed the USB will still boot/load but will fail to boot after installation.

best of luck, Steve ..
edit. wrong date.

FIREMEDIC2700 · Oct 1, 2025

Just a fyi this method only works with 11 25h2. If u are using 11 24h2 u will have to go to upp dump for the latest version of 24h2 .
Modify the ConvertConfig.ini change UpdtBootFiles=0 to UpdtBootFiles=1 and save it to the file . see post 841 for more info

Almighty1 · Oct 1, 2025

KevTech said:
I followed MS instructions and it took me maybe 2 minutes max without having to disable or put secure boot into setup mode.
Everything you need can also be found in Microsoft github.

Yes but you still only have 1 of the 4 keys that are part of the Secured Boot expiring in 2026, you still don't have the other 3 keys. Try using the Microsoft method to get all 4 keys in that 2 minutes. Everything I need does not need Microsoft github either as I am running Windows 11 24H2 Beta Insiders which is updated every 1-2 weeks so it's already on the system, Microsoft just didn't provide instructions on how to use it. So basically you have only 25% of what is really needed while Mosby will provide 75% as the option ROM 2023 is not included until a future version but adding that was a 2 second thing.

Akeo · Oct 1, 2025

bikemanAMD said:
Except when i tried making 25H2 flash drive with Rufus to make 2023 Compatible, it crashed at the end of creating the USB Drive. During Part adding Customizations

Something about Microsoft Visual CC or something, and had option for Abort, Retry or Ignore.

You currently also need to select the first option in Rufus 4.10 if you select the CA 2023 option. See this very relevant FAQ entry, that was also quoted earlier. And yes, selecting the TPM bypass does not mean that TPM will be disabled or unused by Windows if you have it. It only means that Windows setup will bypass the requirement for systems that don't have it. On systems that have TPM 2.0, it does absolutely nothing, so it is safe to leave it enabled.

Margarita · Oct 3, 2025

Using the steps in the Microsoft article, How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

Now have bootable media that works with the old certificate revocation, and Clean installation succeeded without problems

-------------------------------------------------

When messing with the secure boot settings in BIOS, there were two options: Standard and Custom.
The default option is Standard. When switching to Custom and then back to Standard, the "Microsoft Corporation KEK 2K CA 2023" certificate was added, which was not there before.
Also, The revocation of the Windows Production PCA 2011 certificate was also rolled back.

After Enable the revocation again

FIREMEDIC2700 · Oct 3, 2025

The way your setup now is good . That will let you boot from either the 2011 or 2023 cert .
If you revoke the 2011 ca cert , and u have to do a clean install your system will not boot. As of right now they are no iso's with the 2023 cert .
You would have to manually edit the iso to the 2023 cert. when the time comes ms will prob remove it via windows update.

bikemanAMD · Oct 3, 2025

Tried to run the CheckEFIBootfile again script, now i can't even get it to run lol. Well one thing for sure i don't have to worry on BlackLotus, my Desktop very very secure lol. This was last time i get it to run lol

Most likely won't be doing a clean install for a long time, as probably will have issues booting or even doing a clean install. Think i went too far in revoking it too early lol perhaps lol, but at least System Secure lol

FIREMEDIC2700 · Oct 3, 2025

how did u get the option rom 2023 ?
just make you a 2023 iso cert iso boot disk and u will be good

gunrunnerjohn · Oct 3, 2025

FIREMEDIC2700 said:
The way your setup now is good . That will let you boot from either the 2011 or 2023 cert .
If you revoke the 2011 ca cert , and u have to do a clean install your system will not boot. As of right now they are no iso's with the 2023 cert .
You would have to manually edit the iso to the 2023 cert. when the time comes ms will prob remove it via windows update.

https://www.elevenforum.com/attachments/screenshot-2025-10-03-041958-webp.147569/

Wrong, since the 2011 cert is in the DBX database, it will NOT boot with a 2011 boot image. The only thing that will boot now is an image with the Windows 2023 cert or the Microsoft 2011 cert.

bikemanAMD · Oct 3, 2025

Oh ok excellent, checks that.

Not sure how i got the Option Rom 2023, all of a sudden it was there---unless came with last MSI UEFi bios update in July, waiting for 2 more to come out of beta, then will install that security related UEFI bios update, along with Agesa 1.2.0.3f version

Code:

Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011

EFI Files
---------
    Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager.



Bootable Media
--------------
    USB :

    USB F: "ESD-ISO"
        Boot File [Windows UEFI CA 2023] is ALLOWED.
        boot.wim:2    Boot Manager [Windows UEFI CA 2023] is PRESENT.
        install.esd:1 Boot Manager [Windows UEFI CA 2023] is PRESENT.
                         Skipping checks on next 6 images.

Margarita · Oct 3, 2025

I haven't followed this very long post from the beginning, so I may have missed some points, Where are the steps cert revocation“Windows Production CA 2011” ? I don't see anything in the Microsoft article.
does that mean I'm still vulnerable to the Black Lotus vulnerability?

gunrunnerjohn · Oct 3, 2025

Margarita said:
I haven't followed this very long post from the beginning, so I may have missed some points, Where are the steps cert revocation“Windows Production CA 2011” ? I don't see anything in the Microsoft article.
does that mean I'm still vulnerable to the Black Lotus vulnerability?

You appear to be fine if this is your current configuration. The 2011 cert is in the DBX database and revoked.

FIREMEDIC2700 · Oct 3, 2025

gunrunnerjohn said:
https://www.elevenforum.com/attachments/screenshot-2025-10-03-041958-webp.147569/

Wrong, since the 2011 cert is in the DBX database, it will NOT boot with a 2011 boot image. The only thing that will boot now is an image with the Windows 2023 cert or the Microsoft 2011 cert.

thats what i said since he revoked the 2011 cert . and he has to do a clean install the only way he can boot is using a 2023 iso .

Margarita · Oct 3, 2025

FIREMEDIC2700 said:
thats what i said since he revoked the 2011 cert . and he has to do a clean install the only way he can boot is using a 2023 iso .

I already mentioned that I performed a clean installation using modified download media that I obtained by following these steps from a Microsoft article.

These commands modified the efi folder and added additional files.

Did you manually update your Secure Boot Keys ?

Well-known member

Part 2: Creating Windows 11 installation media that works on platforms where PCA 2011 has been revoked.​

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Similar threads

Part 2: Creating Windows 11 installation media that works on platforms where PCA 2011 has been revoked.

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer