Did you manually update your Secure Boot Keys ?

Buddywh · Oct 12, 2025

gunrunnerjohn said:
It's trivial to do the upgrade with Rufus and Mosby, much easier than with the Microsoft procedure. Also, the installation is a bit more secure without the shared Microsoft encoding.

It's also far more complete in that I can get the KEK, the Microsoft DB key, the Windows DB key and as well (now) the OpROM DB key. For some reason all I got before was the Windows DB key (all that's really necessary to validate Windows 2023 signed secure boot binaries I suppose).

And a bonus: it replaces the (possibly compromised) manufacturer supplied PK with one that's unique to your system (as it should be).

The only downside is you have to know how to put the BIOS in SETUP mode. Not really hard to do, but they don't make it an easy find since every one seems to do it in a different way and don't always use the same terms so you know you've got it right. For those of us a bit less familiar with all this it can be daunting the first time.

Just understand that if it goes south you can always start Windows with Secure Boot disabled to recover from just about any state it's in. I know, because I've done it a couple times

gunrunnerjohn · Oct 12, 2025

Yep, disable Secure Boot in the BIOS, and all of this other stuff is moot.

man00 · Oct 12, 2025

Scott said:
@garlin made us a double-clickable script that makes this very easy. It creates a UEFI_report.txt file on your desktop.
Just download the .zip file and extract it wherever you want. Double-click the BoScript.bat file then open the report
on your desktop. Too easy.

Download the script here.

Did you manually update your Secure Boot Keys ?

Not sure why my output looks different to everyone else's after running @Sheikh's script. Especially where it's referenced as EFI not UEFI So EFI preceded UEFI. I get it. I get that I am also probably out of luck. PS C:\Users\XXXXX> powershell -nop -ep bypass -f...

www.elevenforum.com

View attachment 148659

This what I cam up with

gunrunnerjohn · Oct 12, 2025

Mine is pretty complete. I've revoked the 2011 Windows cert.


Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011

EFI Files
---------
    Disk 2: Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager.

Scott · Oct 12, 2025

gunrunnerjohn said:
It's trivial to do the upgrade with Rufus and Mosby, much easier than with the Microsoft procedure.

The MS procedure was all there was when I did mine two years ago.
It's not hard to understand after doing it a few times.

wowchick · Oct 12, 2025

Winuser said:
No. If Secure Boot is disabled the computer won't look for the certificates.

ok ty

toskysea · Oct 13, 2025

toskysea said:
Thanks for the link. Have tried setting uefi.allowAuthBypass = "TRUE" on the VM and able to see the secure boot configurations. I mounted the KEK certificate as an ISO to the VM and when choose to enroll, it wasn't able to detect the ISO for the cert selection for enroll. I have logged a case with Broadcom to see if they can advise.

Update:
I was able modify this "CopyKEK2023_to_EFI" script provided by Garlin previously in this thread, and copied "microsoft corporation kek 2k ca 2023.crt", "microsoft uefi ca 2023.crt" and "microsoft option rom uefi ca 2023.crt" downloaded from Windows Secure Boot Key Creation and Management Guidance to the EFI. Thereafter, booted into the BIOS and enrolled the KEK cert and also added the other 2 certs to the DB. And the final output is shown below. Thank you so much to garlin for the script.

Final output:

toskysea · Oct 13, 2025

Almighty1 said:
Not sure if this will help but try reading this:

How to replace UEFI Secure Boot certificates in VMware

How to replace UEFI Secure Boot certificates in VMware - readme.md

gist.github.com

The .der files you need are located at secureboot_objects/PreSignedObjects at main · microsoft/secureboot_objects
which are the same 4 certificates needed:
1) Microsoft Corporation KEK 2K CA 2023 (KEK) secureboot_objects/PreSignedObjects/KEK/Certificates/microsoft corporation kek 2k ca 2023.der at main · microsoft/secureboot_objects

2) Microsoft Corporation UEFI CA 2023 (DB)

secureboot_objects/PreSignedObjects/DB/Certificates/microsoft uefi ca 2023.der at main · microsoft/secureboot_objects

Secure boot objects recommended by Microsoft. Contribute to microsoft/secureboot_objects development by creating an account on GitHub.

github.com

3) Microsoft Option ROM UEFI CA 2023 (DB)

secureboot_objects/PreSignedObjects/DB/Certificates/microsoft option rom uefi ca 2023.der at main · microsoft/secureboot_objects

Secure boot objects recommended by Microsoft. Contribute to microsoft/secureboot_objects development by creating an account on GitHub.

github.com

4) Windows UEFI CA 2023 (DB)

secureboot_objects/PreSignedObjects/DB/Certificates/windows uefi ca 2023.der at main · microsoft/secureboot_objects

Secure boot objects recommended by Microsoft. Contribute to microsoft/secureboot_objects development by creating an account on GitHub.

github.com

Thanks. I am able to add in certs #1 - #3 via BIOS using .crt files downloaded from Windows Secure Boot Key Creation and Management Guidance.

See my update here: Did you manually update your Secure Boot Keys ?

Cert #4 is the 1st cert added with performing the steps 1 and 2 in How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

SlicEnDicE · Oct 13, 2025

I don't give a rats bum about these certs. I'll pass. Either they get automagically updated or if Windows stops booting, I wipe the whole drive and switch to something else.

Buddywh · Oct 13, 2025

SlicEnDicE said:
I don't give a rats bum about these certs. I'll pass. Either they get automagically updated or if Windows stops booting, I wipe the whole drive and switch to something else.

That was my attitude at first... I was already planning on dumping my computer for a PS 6 (when they come out) to play games and chrome book to manage my affairs (don't really need the horsepower of a desktop for that anymore) should I (or MS) not manage this debacle.

But MOSBY wasn't that hard to figure out and I also got the new keys in BIOS updates for my principle computers. All's ready now so no PS 6 plans in my future

gunrunnerjohn · Oct 13, 2025

Scott said:
The MS procedure was all there was when I did mine two years ago.
It's not hard to understand after doing it a few times.

Most people won't be doing the procedure "a few times", for a majority of folks here it's once-and-done. Maybe twice if they have a laptop.

SlicEnDicE · Oct 13, 2025

Buddywh said:
That was my attitude at first...

My attitude towards MS has changed drastically for the last 12 months. First Windows 11 hardware restrictions, then O365 sub got a big price hike because of AI. Now they shove that AI poop down your throat in Windows and in all MS apps without asking me if I even want it. Now the latest announcement of XBox Gamepass Ultimate price hike of +50% is really close to the final nail in the coffin.

I'm really close to abandoning MS all together. So much crap lately.

Buddywh · Oct 13, 2025

SlicEnDicE said:
My attitude towards MS has changed drastically for the last 12 months. ...

I can really understand that.

And honestly, I feel Microsoft is going to be seeing a steady increase in the decline of their OS installed base over the next several years. Both the demise of Windows 10 support, and the Windows certificates' expiration is going to be a serious double-whammy for the less technically adept when they have problems or collect a boot sector virus from doing easy fixes. After all why go buy a new system when this experience ended so badly, for reasons they can't really understand and don't feel they should have to try to: "I just wanted it to work!"

Those who MUST have the services of a powerful and secure desktop will get it there, but a lot will choose the alternate OS approach instead since they're usually the technically adept anyway.

SlicEnDicE · Oct 13, 2025

Buddywh said:
There's too many good options for people who don't really like messing with their system to keep it running.

Yeah, for the less tech savvy who only need their computers for some photo collections, banking, finances, online shopping, YouTube and Facebook, any potato for a computer with any OS would work. In my country most things can be done easily with a mobile phone, so many over here don't even need a computer for anything. One good example is the Wife. She uses the computer only like once or twice a year, and only because she gets a 32" screen rather than a 6" one.

man00 · Oct 13, 2025

man00 said:
This what I cam up with
View attachment 148699

So do I need to do anything or not?

Buddywh · Oct 13, 2025

man00 said:
So do I need to do anything or not?

Depends on your desired outcome.

You can do nothing else, just wait until Microsoft finishes updates. They should change over to using a boot manager signed with 2023 certificate at some point, and then enforce revoking trust in the 2011 Windows PCA certificate after that.

Or you can do it yourself (instructions are in the KB article below) but first understand what happens when you do (read the Understanding Risks section). When Microsoft does it you know everything they do afterwords will be with awareness your system won't have the ability to Secure Boot with a 2011 signed boot manager, when you do it they may not.

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

gunrunnerjohn · Oct 13, 2025

Microsoft has been supplying Windows with the 2023 certificate for some time now, at least since sometime in 2024. If you're booting other stuff like recovery USB drives, there is a simple batch job to copy the proper certificate to the USB drive. I had to fix the Acronis recovery disk that way since they're still using the 2011 cert on their recovery disk. I had to figure that out and tell them they should fix it.

man00 · Oct 13, 2025

I boot sometime from Macrium rescue disk..does that rewrite the certificates?

gunrunnerjohn · Oct 13, 2025

man00 said:
I boot sometime from Macrium rescue disk..does that rewrite the certificates?

There was a discussion about the Macrium rescue disk and the 2023 certificates. I don't know the exact state since I don't use it, a search should find the thread.

mccmw · Oct 13, 2025

In the future I plan on going the Mosby route on an unsupported machine...i.e. it isn't going to get Asus BIOS update. What are the risks or consequences? If something doesn't go right does your machine get rendered as unbootable...at least with secure boot enabled? If that happens, would you just go in to the BOS, delete all certificates (if the option exists), and run Mosby again?

Did you manually update your Secure Boot Keys ?

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Active member

My Computer

New member

My Computer

New member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Similar threads