Did you manually update your Secure Boot Keys ?

kelper · Oct 21, 2025

I could not get the ps1 script to work until I realised that I had disabled Secure Boot. Now it's all hunky-dory.

wowchick · Oct 21, 2025

how do i run the commands just enabled my secure boot

kelper · Oct 21, 2025

wowchick said:
how do i run the commands just enabled my secure boot

go to post 1

wowchick · Oct 21, 2025

kelper said:
go to post 1

ty

Buddywh · Oct 21, 2025

gunrunnerjohn said:
.... You even got the extra option cert that I never got, I'll round it up if I ever need it.

MOSBY, starting with v2.4 I believe, adds the OpROM certificate now.

It was easy to add to my systems without it though: I just DL'd the signed binaries from Microsoft and then used the APPEND feature in my BIOS to append it into DB.

Phil_C · Oct 21, 2025

Mosby 2.6 did not add the Option ROM cert to my older machine, and that BIOS does not offer control of individual certs. But I ran Mosby again with the -db switch pointing to the cert that I had placed on the Mosby USB drive. This worked. It's in the Mosby readme.

itsme1 · Oct 21, 2025

A future version of mosby will integrate the option ROM.

Edit:
Mosby v2.4
Added installation of Microsoft Option ROM UEFI CA 2023 DB certificate.
So 2.6 should do it too, there's a bug.

Buddywh · Oct 21, 2025

Phil_C said:
Mosby 2.6 did not add the Option ROM cert to my older machine, and that BIOS does not offer control of individual certs. But I ran Mosby again with the -db switch pointing to the cert that I had placed on the Mosby USB drive. This worked. It's in the Mosby readme.

V2.4 added it... but you might drop a note to the Author (PBatard on Github, @Akeo here) that v2.6 didn't update DB with the OpROM on your system.

But how did the "-db" switch work for you: can you do it without putting it in "SETUP MODE" to update just the one certificate? Or does it need that so it adds all the certificates along with the one you specify?

TheVisitor · Oct 21, 2025

OK, got brave and ran the commands from page 1, did 2 restarts and now see:
PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’
True

I assume I'm good ?

After the latest CU update and OOB update I have been getting event id 1801
Secure Boot CA/keys need to be updated. This device signature information is included here.
DeviceAttributes: FirmwareManufacturer:AMI;FirmwareVersion:F.54;OEMModelBaseBoard:8767;OEMManufacturerName:HP;OSArchitecture:amd64;
BucketId: 58c7a62c3d44f62559eac5f9ac4f9891af9ebfd538f37214d41ff5e68b045997
BucketConfidenceLevel:
UpdateType: 0
HResult: The operation completed successfully.

Since the keys were updated, at least it shows 'true'.. what does this mean ?

kelper · Oct 21, 2025

It means that the ‘Windows UEFI CA 2023’ certificate had been added to the dB database and that you are good to go.

TheVisitor · Oct 21, 2025

kelper said:
It means that the ‘Windows UEFI CA 2023’ certificate had been added to the dB database and that you are good to go.

But why the error event for the TPM ? I would of thought that would clear up.

itsme1 · Oct 21, 2025

Secure Boot DB and DBX variable update events | Microsoft Support

Secure Boot DB and DBX variable update events

support.microsoft.com

"Event ID: 1801
This is an error event that indicates that the updated certificates have not been applied to the device’s firmware. This event gives some details about the device, including device attributes and device bucket ID, that will help in correlating which devices still need updating.

If the confidence level of the device’s ability to accept the updates is known, it will be included in the event. The values include "High Confidence", "Needs More Data", "Unknown", and "Paused". The UpdateType will be either 0, or 22852 (0x5944). The value 0x5944 corresponds to “High Confidence”."

I think this indicates that the certificate(s) in windows have not been applied to the firmware. You used mosby everything is fine, but windows does not know this and gives you this error.
To no longer have this error, I think you have to apply the certificate manually (because for now it is only manual) with the Microsoft guide, which for the moment only includes a 2023 certificate, the others will soon be available to do manually or via kb windows update.

TheVisitor · Oct 21, 2025

@itsme1 OK, thanks. I'll wait for the WU I guess.

PerpetualCycle · Oct 21, 2025

gunrunnerjohn said:
That looked like what I expected! Looks like you're all good. You even got the extra option cert that I never got, I'll round it up if I ever need it.

here is a another way to install the certs that includes the Option ROM Cert:

Re: Windows UEFI CA 2023

Hi, Thank you , I missed this Microsoft support page published the same day (14 October 2025) as the KB5066835 update (which brings Secure Boot Windows UEFI CA 2023 certificates updates) : https://support.microsoft.com/topic/a7be69c9-4634-42e1-9ca1-df06f43f360d I made an Secure Boot Windows UEFI...

rog-forum.asus.com

kelper · Oct 21, 2025

Now that I have the 2023 certificate, should I revoke the 2011 one?

gunrunnerjohn · Oct 21, 2025

PerpetualCycle said:
here is a another way to install the certs that includes the Option ROM Cert:

Re: Windows UEFI CA 2023

Hi, Thank you , I missed this Microsoft support page published the same day (14 October 2025) as the KB5066835 update (which brings Secure Boot Windows UEFI CA 2023 certificates updates) : https://support.microsoft.com/topic/a7be69c9-4634-42e1-9ca1-df06f43f360d I made an Secure Boot Windows UEFI...

rog-forum.asus.com

Download from and unknown source with no documentation and turn it loose on my system? I don't think that's the best way to do something like updating your Secure Boot certificates!

PerpetualCycle · Oct 21, 2025

gunrunnerjohn said:
Download from and unknown source with no documentation and turn it loose on my system? I don't think that's the best way to do something like updating your Secure Boot certificates!

It is from Mokitchu. You can look at the source, it is safe. I always check that it is safe.

Here are two of the command files. He doesn't provide any files but just initiates the update through windows. Windows gets the certs and does the update.

Setup.cmd

Code:

@echo off
%windir%\system32\reg.exe query "HKU\S-1-5-19" >nul 2>&1 || (
echo /!\ Executer en tant qu'administrateur /!\
echo.
echo Appuyer sur une touche pour quitter ...
pause >nul
exit
)
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
pause

Update.cmd

Code:

@echo off

%windir%\system32\reg.exe query "HKU\S-1-5-19" >nul 2>&1 || (

echo /!\ Executer en tant qu'administrateur /!\

echo.

echo Appuyer sur une touche pour quitter ...

pause >nul

exit

)

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

pause

itsme1 · Oct 21, 2025

TheVisitor said:
@itsme1 OK, thanks. I'll wait for the WU I guess.

Yes, wait, there are several certificates that will arrive plus a revocation.

gunrunnerjohn · Oct 21, 2025

PerpetualCycle said:
It is from Mokitchu. You can look at the source, it is safe.

OK, I did look at it. Since it's in French, I think I'll wait for the English version.

PerpetualCycle · Oct 21, 2025

gunrunnerjohn said:
OK, I did look at it. Since it's in French, I think I'll wait for the English version.

Here is another official source. All the code above does is initiate the update for IT enterprise, which includes the Option ROM. It is basically the same as you have done, but uses a different Registry DWORD 0x5944. Ignore all the other IT steps below.

Secure Boot playbook for certificates expiring in 2026

Explore tools and step-by-step guidance to help you proactively update your Secure Boot certificates.

techcommunity.microsoft.com

Did you manually update your Secure Boot Keys ?

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Similar threads

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers