Solved Fresh Windows 11 25H2 installation(Rufus) with Windows UEFI CA 2023 certificate?


I think is wise not to ban the old certificate so you can boot by either one. What if you want to reinstall Windows 11 24H2 or even Windows 10?
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 23H2 (5699), 25H2 (8737)Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz4GBMobile Intel(R) GMA 4500M (Mobile 4 series)
    OS
    Windows 11 Pro 23H2 (5699), 25H2 (8737)
    Computer type
    Laptop
    Manufacturer/Model
    Acer Extensa 5630EZ
    CPU
    Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz
    Motherboard
    Acer Extensa 5630
    Memory
    4GB
    Graphics Card(s)
    Mobile Intel(R) GMA 4500M (Mobile 4 series)
    Sound Card
    Realtek ALC268 @ Intel 82801IB ICH9 - High Definition Audio Controller
    Monitor(s) Displays
    1
    Screen Resolution
    1280x800
    Hard Drives
    Samsung SSD 850 EVO 250GB SATA Device (250 GB, SATA-III)
    Internet Speed
    VDSL 50 Mbps
    Browser
    MICROSOFT EDGE
    Antivirus
    WINDOWS DEFENDER
    Other Info
    Legacy MBR installation, no TPM, no Secure Boot, no WDDM 2.0 graphics drivers, no SSE4.2, cannot get more unsupported ;) This is only my test laptop. I had installed Windows 11 here before upgrading my main PC. For my main PC I use everyday see my 2nd system specs.

  • At a glance

    Windows 11 Pro v25H2 (build 26200.8737)Intel Core-i7 3770 3.40GHz s1155 (3rd generat...2x Kingston Hyper-X Blu 8GB DDR3-1600GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB...
    Operating System
    Windows 11 Pro v25H2 (build 26200.8737)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom-built PC
    CPU
    Intel Core-i7 3770 3.40GHz s1155 (3rd generation)
    Motherboard
    Asus P8H61 s1155 ATX
    Memory
    2x Kingston Hyper-X Blu 8GB DDR3-1600
    Graphics card(s)
    GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB (GV-N3050WF2OCV2-6GD)
    Sound Card
    Realtek HD audio (ALC887)
    Monitor(s) Displays
    Sony Bravia KDL-19L4000 19" LCD TV via VGA
    Screen Resolution
    1440x900 32-bit 60Hz
    Hard Drives
    WD Blue SA510 2.5 1000GB SSD as system disk, Western Digital Caviar Purple 4TB SATA III (WD40PURZ) as second
    PSU
    Thermaltake Litepower RGB 550W Full Wired
    Case
    SUPERCASE MIDI-TOWER
    Cooling
    Deepcool Gamma Archer CPU cooler, 1x 8cm fan at the back
    Keyboard
    Mitsumi 101-key PS/2
    Mouse
    Sunnyline OptiEye PS/2
    Internet Speed
    100Mbps
    Browser
    Microsoft Edge, Mozilla Firefox
    Antivirus
    Microsoft Windows Defender
    Other Info
    Legacy BIOS (MBR) installation, no TPM, no Secure Boot, WDDM 3.0 graphics drivers, WEI score 7.4
The point of banning CA 2011 is to prevent Black Lotus UEFI attacks (or variants of the same thing) from happening. You can always temporarily disable Secure Boot when needed to re-install Windows. This was the original guidance when Rufus 2.0 was first released.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
antspants said:
mountvol s: /S Get-PfxCertificate -FilePath "S:\EFI\Microsoft\Boot\bootmgfw.efi"
Click to expand...

S: is my Software Partition. :D

EFI is on Z: or at least - that's what was assign using this simple EFI mounting tool: Releases · franzageek/WinEFIMounter (rather useful for a system with multiple partitions and multiple storage devices - especially if S: is assigned :)
 

My Computer My Computer

At a glance

WinDOS 25H2Intel & AMDSO-DIMM SK Hynix 15.8 GB Dual-Channel DDR4-26...nVidia RTX 2060 6GB Mobile GPU (TU106M)
OS
WinDOS 25H2
Computer type
Laptop
CPU
Intel & AMD
Memory
SO-DIMM SK Hynix 15.8 GB Dual-Channel DDR4-2666 (2 x 8 GB) 1329MHz (19-19-19-43)
Graphics Card(s)
nVidia RTX 2060 6GB Mobile GPU (TU106M)
Sound Card
Onbord Realtek ALC1220
Screen Resolution
1920 x 1080
Hard Drives
1x Samsung PM981 NVMe PCIe M.2 512GB / 1x Seagate Expansion ST1000LM035 1TB
antspants said:
Use PowerShell to inspect the bootloader signature:
Powershell: 
mountvol s: /S
Get-PfxCertificate -FilePath "S:\EFI\Microsoft\Boot\bootmgfw.efi"
Click to expand...
This won't work. Get-PFXCertificate isn't a native PowerShell command, it's the name of a private function in my UEFI check script.

This command works for everyone:
Code: 
mountvol s: /S
powershell ((Get-AuthenticodeSignature "S:\EFI\Microsoft\Boot\bootmgfw.efi").SignerCertificate.Issuer).split('=')[1].split(',')[0]
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Hi folks, as long as the CPU will support SSE 4.2 Instruction Set you should not have any issues installing Windows 11 25H2.
 

My Computer My Computer

At a glance

Windows 11 Home Build 24H2 All Updates Installed9370 AMD FX 8 Core 4.7 GHZKingston 32 GB 1600MHz XMP Profile EnabledGTX 1050 Ti 4GB OPTIMIZED
OS
Windows 11 Home Build 24H2 All Updates Installed
Computer type
PC/Desktop
Manufacturer/Model
AMD Gigabyte System
CPU
9370 AMD FX 8 Core 4.7 GHZ
Motherboard
Gigabyte 990FXA UD5 ( 2013 )
Memory
Kingston 32 GB 1600MHz XMP Profile Enabled
Graphics Card(s)
GTX 1050 Ti 4GB OPTIMIZED
Sound Card
Gigabyte Dolby 5 Channel Surround Sound
Monitor(s) Displays
47 Inch Panasonic LED TV
Screen Resolution
1920 by 1080 HD
Hard Drives
Western Digital 1 TB Blue for Windows and a Seagate Hybrid SSD 2 TB HDD 256 MB Cache for the Games.
PSU
Seasonic 1050 WATT 80 Plus Gold
Case
NZXT
Cooling
AMD FX Liquid CPU Cooler
Keyboard
Microsoft Sculpt
Mouse
TUF Gaming Mouse 16000 DPI
Internet Speed
100 MB /Second
Browser
FIrefox 64 bit
Antivirus
WIndows Defender
Other Info
High End Old school system I picked up this year for $200.00 CA. It plays most average games without overclocking. Also some AAA Titles with the System optimized. Most time I run the GPU undervolted and reduced clock speeds and the Cpu at a reduced speed to keep gaming temps down. My average FPS are Between 60 and 85. Temps CPU 35 and GPU 40. Normal gaming settings CPU is Around 45 degrees C and the GPU is around 50 degrees C. FPS up to 85. V-sync turned Off. Games played are American Truck Simulator Plague Innocence and Plague Requiem Horizon Zero Dawn Balders Gate 3 DreamFall Chapters Final Cut. No gaming issues.
datawizard551 said:
Hi folks, as long as the CPU will support SSE 4.2 Instruction Set you should not have any issues installing Windows 11 25H2.
Click to expand...
Yes, if you bypass compatibility check you can clean install Windows 11 25H2 or upgrade from Windows 10 and old Windows 11 versions. If you already run 24H2 a full upgrade is not necessary, just download and install the 25H2 Enablement Package to switch version from 24H2 to 25H2. However, those that are Windows 11 compliant and use TPM 2.0 and Secure Boot to protect the disk, should pay attention to the old (2011) or new (2023) certificate or they might not be able to boot! For the rest of us that do not use TMP and Secure Boot or not even have them, there is no danger. An advantage of having an unsupported Windows 11 installation. Windows 11 compliant computers can avoid certificate issues if they leave both 2011 and 2023 certificates and NOT ban the 2011 certificate. Besides, the only way a hacker could possibly exploit Boot record, would be if he has physical access to your PC or embeds a virus at the bootloader of a suspicious ISO. Always download your ISO from Microsoft or well known sites. Avoid anything else. Those that look for suspicious ISOs to illegally activate Windows 11 after installation risk being locked out and not able to boot into their computers. It serves them right.

Scroll down to third option to download the ISO directly. Currently 24H2 is available, but in a month there should be 25H2.
 
Last edited:

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 23H2 (5699), 25H2 (8737)Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz4GBMobile Intel(R) GMA 4500M (Mobile 4 series)
    OS
    Windows 11 Pro 23H2 (5699), 25H2 (8737)
    Computer type
    Laptop
    Manufacturer/Model
    Acer Extensa 5630EZ
    CPU
    Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz
    Motherboard
    Acer Extensa 5630
    Memory
    4GB
    Graphics Card(s)
    Mobile Intel(R) GMA 4500M (Mobile 4 series)
    Sound Card
    Realtek ALC268 @ Intel 82801IB ICH9 - High Definition Audio Controller
    Monitor(s) Displays
    1
    Screen Resolution
    1280x800
    Hard Drives
    Samsung SSD 850 EVO 250GB SATA Device (250 GB, SATA-III)
    Internet Speed
    VDSL 50 Mbps
    Browser
    MICROSOFT EDGE
    Antivirus
    WINDOWS DEFENDER
    Other Info
    Legacy MBR installation, no TPM, no Secure Boot, no WDDM 2.0 graphics drivers, no SSE4.2, cannot get more unsupported ;) This is only my test laptop. I had installed Windows 11 here before upgrading my main PC. For my main PC I use everyday see my 2nd system specs.

  • At a glance

    Windows 11 Pro v25H2 (build 26200.8737)Intel Core-i7 3770 3.40GHz s1155 (3rd generat...2x Kingston Hyper-X Blu 8GB DDR3-1600GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB...
    Operating System
    Windows 11 Pro v25H2 (build 26200.8737)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom-built PC
    CPU
    Intel Core-i7 3770 3.40GHz s1155 (3rd generation)
    Motherboard
    Asus P8H61 s1155 ATX
    Memory
    2x Kingston Hyper-X Blu 8GB DDR3-1600
    Graphics card(s)
    GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB (GV-N3050WF2OCV2-6GD)
    Sound Card
    Realtek HD audio (ALC887)
    Monitor(s) Displays
    Sony Bravia KDL-19L4000 19" LCD TV via VGA
    Screen Resolution
    1440x900 32-bit 60Hz
    Hard Drives
    WD Blue SA510 2.5 1000GB SSD as system disk, Western Digital Caviar Purple 4TB SATA III (WD40PURZ) as second
    PSU
    Thermaltake Litepower RGB 550W Full Wired
    Case
    SUPERCASE MIDI-TOWER
    Cooling
    Deepcool Gamma Archer CPU cooler, 1x 8cm fan at the back
    Keyboard
    Mitsumi 101-key PS/2
    Mouse
    Sunnyline OptiEye PS/2
    Internet Speed
    100Mbps
    Browser
    Microsoft Edge, Mozilla Firefox
    Antivirus
    Microsoft Windows Defender
    Other Info
    Legacy BIOS (MBR) installation, no TPM, no Secure Boot, WDDM 3.0 graphics drivers, WEI score 7.4
spapakons said:
Yes, if you bypass compatibility check you can clean install Windows 11 25H2 or upgrade from Windows 10 and old Windows 11 versions. If you already run 24H2 a full upgrade is not necessary, just download and install the 25H2 Enablement Package to switch version from 24H2 to 25H2. However, those that are Windows 11 compliant and use TPM 2.0 and Secure Boot to protect the disk, should pay attention to the old (2011) or new (2023) certificate or they might not be able to boot! For the rest of us that do not use TMP and Secure Boot or not even have them, there is no danger. An advantage of having an unsupported Windows 11 installation. Windows 11 compliant computers can avoid certificate issues if they leave both 2011 and 2023 certificates and NOT ban the 2011 certificate. Besides, the only way a hacker could possibly exploit Boot record, would be if he has physical access to your PC or embeds a virus at the bootloader of a suspicious ISO. Always download your ISO from Microsoft or well known sites. Avoid anything else. Those that look for suspicious ISOs to illegally activate Windows 11 after installation risk being locked out and not able to boot into their computers. It serves them right.

Scroll down to third option to download the ISO directly. Currently 24H2 is available, but in a month there should be 25H2.
Click to expand...

I am using rufus 4,10 + 25H2 iso to create bootable usb

is it recommended to enable CA 2023 option?

My system is not compatible with windows 11 requirements so i enable the option to bypass the checks
 

My Computer My Computer

At a glance

Windows 10
OS
Windows 10
madmax2 said:
I am using rufus 4,10 + 25H2 iso to create bootable usb

is it recommended to enable CA 2023 option?

My system is not compatible with windows 11 requirements so i enable the option to bypass the checks
Click to expand...
No, because the USB might not boot with Secure Boot enabled, unless you also upgrade the certificate in BIOS. Better avoid it for now.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 23H2 (5699), 25H2 (8737)Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz4GBMobile Intel(R) GMA 4500M (Mobile 4 series)
    OS
    Windows 11 Pro 23H2 (5699), 25H2 (8737)
    Computer type
    Laptop
    Manufacturer/Model
    Acer Extensa 5630EZ
    CPU
    Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz
    Motherboard
    Acer Extensa 5630
    Memory
    4GB
    Graphics Card(s)
    Mobile Intel(R) GMA 4500M (Mobile 4 series)
    Sound Card
    Realtek ALC268 @ Intel 82801IB ICH9 - High Definition Audio Controller
    Monitor(s) Displays
    1
    Screen Resolution
    1280x800
    Hard Drives
    Samsung SSD 850 EVO 250GB SATA Device (250 GB, SATA-III)
    Internet Speed
    VDSL 50 Mbps
    Browser
    MICROSOFT EDGE
    Antivirus
    WINDOWS DEFENDER
    Other Info
    Legacy MBR installation, no TPM, no Secure Boot, no WDDM 2.0 graphics drivers, no SSE4.2, cannot get more unsupported ;) This is only my test laptop. I had installed Windows 11 here before upgrading my main PC. For my main PC I use everyday see my 2nd system specs.

  • At a glance

    Windows 11 Pro v25H2 (build 26200.8737)Intel Core-i7 3770 3.40GHz s1155 (3rd generat...2x Kingston Hyper-X Blu 8GB DDR3-1600GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB...
    Operating System
    Windows 11 Pro v25H2 (build 26200.8737)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom-built PC
    CPU
    Intel Core-i7 3770 3.40GHz s1155 (3rd generation)
    Motherboard
    Asus P8H61 s1155 ATX
    Memory
    2x Kingston Hyper-X Blu 8GB DDR3-1600
    Graphics card(s)
    GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB (GV-N3050WF2OCV2-6GD)
    Sound Card
    Realtek HD audio (ALC887)
    Monitor(s) Displays
    Sony Bravia KDL-19L4000 19" LCD TV via VGA
    Screen Resolution
    1440x900 32-bit 60Hz
    Hard Drives
    WD Blue SA510 2.5 1000GB SSD as system disk, Western Digital Caviar Purple 4TB SATA III (WD40PURZ) as second
    PSU
    Thermaltake Litepower RGB 550W Full Wired
    Case
    SUPERCASE MIDI-TOWER
    Cooling
    Deepcool Gamma Archer CPU cooler, 1x 8cm fan at the back
    Keyboard
    Mitsumi 101-key PS/2
    Mouse
    Sunnyline OptiEye PS/2
    Internet Speed
    100Mbps
    Browser
    Microsoft Edge, Mozilla Firefox
    Antivirus
    Microsoft Windows Defender
    Other Info
    Legacy BIOS (MBR) installation, no TPM, no Secure Boot, WDDM 3.0 graphics drivers, WEI score 7.4
madmax2 said:
I am using rufus 4,10 + 25H2 iso to create bootable usb

is it recommended to enable CA 2023 option?

My system is not compatible with windows 11 requirements so i enable the option to bypass the checks
Click to expand...

Is Rufus showing the ISO when you click "DOWNLOAD" (mine is only showing 24H2) or you downloaded the ISO from software-static.download.prss.microsoft.com ?
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
tenuser1967 said:
Is Rufus showing the ISO when you click "DOWNLOAD" (mine is only showing 24H2) or you downloaded the ISO from software-static.download.prss.microsoft.com ?
Click to expand...

yeah I downloaded separately from


It is also now available on official microsoft windows 11 release page

However, I not sure why the ISO I downloaded (1905.25h2_ge_release_svc_refresh_CLIENT_CONSUMER_x64FRE_en-us.iso) is not matching with MD5 on Microsoft Windows 11 release page .. so probably better to just get it from there.

MD5
English 64-bit = D141F6030FED50F75E2B03E1EB2E53646C4B21E5386047CB860AF5223F102A32
English International 64-bit = BAAEB6C90DD51648154B64C40C9E0C14D93A427F611A1BB49C8077FA2FF73364
 
Last edited:

My Computer My Computer

At a glance

Windows 10
OS
Windows 10
spapakons said:
No, because the USB might not boot with Secure Boot enabled, unless you also upgrade the certificate in BIOS. Better avoid it for now.
Click to expand...

oic... thanks

my motherboard is pretty old so I don't think it has secure boot option (even though it has UEFI)

Just trying to understand this CA 2023 option..
this is a patch certificate that fixes a black lotus vulnerability?

And if we enable that option it means
the bootable USB windows 11 25H2 would use that certificate CA 2023 and also bios (that has secure boot mode) would also need an updated bios firmware that has CA 2023 certificate?

Also can you explain simply of is the black lotus vulnerability?
 

My Computer My Computer

At a glance

Windows 10
OS
Windows 10
madmax2 said:
yeah I downloaded separately from


It is also now available on official microsoft windows 11 release page

However, I not sure why the ISO I downloaded (1905.25h2_ge_release_svc_refresh_CLIENT_CONSUMER_x64FRE_en-us.iso) is not matching with MD5 on Microsoft Windows 11 release page .. so probably better to just get it from there.
Click to expand...

These are the same ISO's (just renamed differently):
Win11_25H2_English_x64.iso
26200.6584.250915-1905.25h2_ge_release_svc_refresh_CLIENT_CONSUMER_x64FRE_en-us.iso

Code: 
Size: 7736125440 bytes
CRC32: 28CC9384
SHA256: d141f6030fed50f75e2b03e1eb2e53646c4b21e5386047cb860af5223f102a32
SHA1: 57cc59c31ffcc0c54d19aa0314bb33a8c4415754
MD5: 6b05bba98d7b55d299792c08080d6a56

The static URL is obviously fixed, while you have to go thru the Windows 11 ISO download page to get a dynamic link.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
madmax2 said:
oic... thanks

my motherboard is pretty old so I don't think it has secure boot option (even though it has UEFI)

Just trying to understand this CA 2023 option..
this is a patch certificate that fixes a black lotus vulnerability?

And if we enable that option it means
the bootable USB windows 11 25H2 would use that certificate CA 2023 and also bios (that has secure boot mode) would also need an updated bios firmware that has CA 2023 certificate?

Also can you explain simply of is the black lotus vulnerability?
Click to expand...
Plain English:

Unless your PC is newer (or has an updated BIOS within the past 1-2 years), the UEFI only trusts CA 2011-signed files when Secure Boot is enabled. If you follow Microsoft's update steps (which are still optional for now), you can add CA 2023 to the UEFI. This makes it dual-bootable with either version of the boot files.

The final step in the update process (which is still optional for now) is to block CA 2011, so Black Lotus-style exploits can't be used. But revoking the CA 2011 requires replacing the boot file from a Windows EFI folder. Rufus has the option to automate this file copying. You won't need Rufus to perform this duty unless you've already revoked CA 2011.

Rufus will warn if your ISO image has the older boot file, mostly for your awareness. When Secure Boot is disabled, then any version of Windows can booted regardless of whether the Black Lotus fixes have been rolled out. That's always your safeguard in case you find yourself needing to boot an unpatched Windows image for any reason.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
Unless your PC is newer (or has an updated BIOS within the past 1-2 years), the UEFI only trusts CA 2011-signed files when Secure Boot is enabled.
Click to expand...

My PC is quite old (P8Z68-V PRO) but has UEFI bios.
There is no secure boot mode setting
and in msinfo32 it shows
- Secure Boot State = Unsupported

So does that mean UEFI is NOT even checking the windows 11 installation files as being signed with CA 2011 since there is no secure boot support?
Basically it is blindly trusting those installation files
e.g. like a security guard just letting everyone in the venue (PC) without checking their ID

garlin said:
you can add CA 2023 to the UEFI.
Click to expand...

So the bootable 25H2 usb can add CA 2023 to the UEFI...
is that temporary while it has booted the USB or permanently?
And do we need to installed an updated BIOS firmware (with CA 2023 added to UEFI) to make it permanent?

garlin said:
The final step in the update process (which is still optional for now) is to block CA 2011, so Black Lotus-style exploits can't be used
Click to expand...

Can you explain simply what Black Lotus exploits is and how dangerous is?
If you can use an analogy would also be helpful in understanding.

If I installed Windows 11 25H2 now, is there any way Microsoft could stop future updates e.g. 26H2 or beyond
by forcing CA2023 or whatever security measure to block unsupported PC from getting future updates and security patches?

-------------------------------------------------------------------------------------------------------------------------------------------

Unfortunately Windows 10 deadline is approaching and while I did sign up for FREE 1 year security updates
but next year it will be the same EOL issue again..
unless Microsoft extends the free security updates again or we need to pay them etc..

So I am setting up Windows 11 now on another SSD clean install.

BTW is there any apps/exploits that allow upgrading existing windows 10 PC that is unsupported on Windows 11?
 

My Computer My Computer

At a glance

Windows 10
OS
Windows 10
madmax2 said:
My PC is quite old (P8Z68-V PRO) but has UEFI bios.
There is no secure boot mode setting
and in msinfo32 it shows
- Secure Boot State = Unsupported
Click to expand...

This motherboard doesn't support Secure Boot, it's too old. The last BIOS update was "Version 3603 (Only for Win7 & Win8) 2012/11/27", which was when Secure Boot was being introduced.

None of the UEFI mitigation steps for Black Lotus will matter for you. You don't need Rufus to do anything special for you. Just ignore everything, because Windows will probably error out while trying to update the UEFI. And even if it replaced your boot file, there is no Secure Boot enforcement to make it incompatible.

You should consider a new PC, or a less outdated motherboard, to run W11 if you want to have Secure Boot security.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Even if the motherboard has Secure Boot, it's disabled by default if you have both UEFI and CSM (aka Legacy BIOS) boot enabled. To enable Secure Boot you must first disable CSM (set UEFI only), but then you cannot boot old USB flash drives or disks made to boot in Legacy BIOS mode.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 23H2 (5699), 25H2 (8737)Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz4GBMobile Intel(R) GMA 4500M (Mobile 4 series)
    OS
    Windows 11 Pro 23H2 (5699), 25H2 (8737)
    Computer type
    Laptop
    Manufacturer/Model
    Acer Extensa 5630EZ
    CPU
    Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz
    Motherboard
    Acer Extensa 5630
    Memory
    4GB
    Graphics Card(s)
    Mobile Intel(R) GMA 4500M (Mobile 4 series)
    Sound Card
    Realtek ALC268 @ Intel 82801IB ICH9 - High Definition Audio Controller
    Monitor(s) Displays
    1
    Screen Resolution
    1280x800
    Hard Drives
    Samsung SSD 850 EVO 250GB SATA Device (250 GB, SATA-III)
    Internet Speed
    VDSL 50 Mbps
    Browser
    MICROSOFT EDGE
    Antivirus
    WINDOWS DEFENDER
    Other Info
    Legacy MBR installation, no TPM, no Secure Boot, no WDDM 2.0 graphics drivers, no SSE4.2, cannot get more unsupported ;) This is only my test laptop. I had installed Windows 11 here before upgrading my main PC. For my main PC I use everyday see my 2nd system specs.

  • At a glance

    Windows 11 Pro v25H2 (build 26200.8737)Intel Core-i7 3770 3.40GHz s1155 (3rd generat...2x Kingston Hyper-X Blu 8GB DDR3-1600GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB...
    Operating System
    Windows 11 Pro v25H2 (build 26200.8737)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom-built PC
    CPU
    Intel Core-i7 3770 3.40GHz s1155 (3rd generation)
    Motherboard
    Asus P8H61 s1155 ATX
    Memory
    2x Kingston Hyper-X Blu 8GB DDR3-1600
    Graphics card(s)
    GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB (GV-N3050WF2OCV2-6GD)
    Sound Card
    Realtek HD audio (ALC887)
    Monitor(s) Displays
    Sony Bravia KDL-19L4000 19" LCD TV via VGA
    Screen Resolution
    1440x900 32-bit 60Hz
    Hard Drives
    WD Blue SA510 2.5 1000GB SSD as system disk, Western Digital Caviar Purple 4TB SATA III (WD40PURZ) as second
    PSU
    Thermaltake Litepower RGB 550W Full Wired
    Case
    SUPERCASE MIDI-TOWER
    Cooling
    Deepcool Gamma Archer CPU cooler, 1x 8cm fan at the back
    Keyboard
    Mitsumi 101-key PS/2
    Mouse
    Sunnyline OptiEye PS/2
    Internet Speed
    100Mbps
    Browser
    Microsoft Edge, Mozilla Firefox
    Antivirus
    Microsoft Windows Defender
    Other Info
    Legacy BIOS (MBR) installation, no TPM, no Secure Boot, WDDM 3.0 graphics drivers, WEI score 7.4
WARNING:
I installed Windows UEFI CA 2023 certificate using the windows 11 install routine.
My motherboard, an ASUS H97M-PLUS has SATA RAID 0 Array configured to boot windows 11.
I discovered I no longer have the ability to configure or even view the status of my Array at boot time which is critical to manage RAID Boot configuration. It just doesn't show the RAID BIOS status anymore. Windows apps cannot modify a windows boot array. The BIOS revision is the latest version for this board, has not changed with the certificate update, and I can no longer reflash it as although it is the official BIOS file; the outdated bootloader database inside tells my motherboard the official BIOS file is not genuinely the official version anymore (corrupted). So I cannot recover from this bug. When the RAID 0 Array of mine malfunctions that's the end of bootable RAID on my motherboard forever.
I wonder just how many other systems will be effected when this crippling effect gets forced.
 

My Computer My Computer

At a glance

11Intel Core i5 469016GB DDR3Intel HD Graphics 4600
OS
11
Computer type
PC/Desktop
Manufacturer/Model
Asus
CPU
Intel Core i5 4690
Motherboard
H97M-PLUS
Memory
16GB DDR3
Graphics Card(s)
Intel HD Graphics 4600
Sound Card
Realtek HD audio
Monitor(s) Displays
SONIQ
Screen Resolution
1366x768
Hard Drives
5 x 250GB RAID 0
PSU
500W
Case
Classic black
Cooling
Fans
Keyboard
Microsoft
Mouse
Microsoft
Internet Speed
not bad
Browser
Firefox
Antivirus
Microsoft
Are you sure the BIOS update is valid from both the motherboard BIOS and the RAID controller? Maybe it is a separate download and once installed you will be able to boot again. If you don't have access to your computer because of this, you can boot with a WinPE USB and run the update from there. Once very good one with many diagnostic tools is Sergei Strelec's WinPE:

sergeistrelec.name

WinPE 10-8 Sergei Strelec English » Sergei Strelec

Bootable disk Windows 11 and 10 PE - for maintenance of computers, hard disks and partitions, backup and restore disks and partitions, computer diagnostics, data recovery, Windows installation. WinPE x64 version only
sergeistrelec.name sergeistrelec.name

PS: What if you temporarily disable Secure Boot? Can you access the RAID configuration? Can you boot to Windows?
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 23H2 (5699), 25H2 (8737)Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz4GBMobile Intel(R) GMA 4500M (Mobile 4 series)
    OS
    Windows 11 Pro 23H2 (5699), 25H2 (8737)
    Computer type
    Laptop
    Manufacturer/Model
    Acer Extensa 5630EZ
    CPU
    Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz
    Motherboard
    Acer Extensa 5630
    Memory
    4GB
    Graphics Card(s)
    Mobile Intel(R) GMA 4500M (Mobile 4 series)
    Sound Card
    Realtek ALC268 @ Intel 82801IB ICH9 - High Definition Audio Controller
    Monitor(s) Displays
    1
    Screen Resolution
    1280x800
    Hard Drives
    Samsung SSD 850 EVO 250GB SATA Device (250 GB, SATA-III)
    Internet Speed
    VDSL 50 Mbps
    Browser
    MICROSOFT EDGE
    Antivirus
    WINDOWS DEFENDER
    Other Info
    Legacy MBR installation, no TPM, no Secure Boot, no WDDM 2.0 graphics drivers, no SSE4.2, cannot get more unsupported ;) This is only my test laptop. I had installed Windows 11 here before upgrading my main PC. For my main PC I use everyday see my 2nd system specs.

  • At a glance

    Windows 11 Pro v25H2 (build 26200.8737)Intel Core-i7 3770 3.40GHz s1155 (3rd generat...2x Kingston Hyper-X Blu 8GB DDR3-1600GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB...
    Operating System
    Windows 11 Pro v25H2 (build 26200.8737)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom-built PC
    CPU
    Intel Core-i7 3770 3.40GHz s1155 (3rd generation)
    Motherboard
    Asus P8H61 s1155 ATX
    Memory
    2x Kingston Hyper-X Blu 8GB DDR3-1600
    Graphics card(s)
    GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB (GV-N3050WF2OCV2-6GD)
    Sound Card
    Realtek HD audio (ALC887)
    Monitor(s) Displays
    Sony Bravia KDL-19L4000 19" LCD TV via VGA
    Screen Resolution
    1440x900 32-bit 60Hz
    Hard Drives
    WD Blue SA510 2.5 1000GB SSD as system disk, Western Digital Caviar Purple 4TB SATA III (WD40PURZ) as second
    PSU
    Thermaltake Litepower RGB 550W Full Wired
    Case
    SUPERCASE MIDI-TOWER
    Cooling
    Deepcool Gamma Archer CPU cooler, 1x 8cm fan at the back
    Keyboard
    Mitsumi 101-key PS/2
    Mouse
    Sunnyline OptiEye PS/2
    Internet Speed
    100Mbps
    Browser
    Microsoft Edge, Mozilla Firefox
    Antivirus
    Microsoft Windows Defender
    Other Info
    Legacy BIOS (MBR) installation, no TPM, no Secure Boot, WDDM 3.0 graphics drivers, WEI score 7.4
spapakons said:
Are you sure the BIOS update is valid from both the motherboard BIOS and the RAID controller? Maybe it is a separate download and once installed you will be able to boot again. If you don't have access to your computer because of this, you can boot with a WinPE USB and run the update from there. Once very good one with many diagnostic tools is Sergei Strelec's WinPE:

sergeistrelec.name

WinPE 10-8 Sergei Strelec English » Sergei Strelec

Bootable disk Windows 11 and 10 PE - for maintenance of computers, hard disks and partitions, backup and restore disks and partitions, computer diagnostics, data recovery, Windows installation. WinPE x64 version only
sergeistrelec.name sergeistrelec.name

PS: What if you temporarily disable Secure Boot? Can you access the RAID configuration? Can you boot to Windows?
Click to expand...
I've been through disabling secure boot , The BIOS file is valid and from the vendor there is no separate download, the effect is permanent and non reversable CA 2023 gets planted without changing BIOS version information and that makes the BIOS think official BIOS update is just corrupted. I have tried WinPE environments too. Nothing will reverse the damage.
 

My Computer My Computer

At a glance

11Intel Core i5 469016GB DDR3Intel HD Graphics 4600
OS
11
Computer type
PC/Desktop
Manufacturer/Model
Asus
CPU
Intel Core i5 4690
Motherboard
H97M-PLUS
Memory
16GB DDR3
Graphics Card(s)
Intel HD Graphics 4600
Sound Card
Realtek HD audio
Monitor(s) Displays
SONIQ
Screen Resolution
1366x768
Hard Drives
5 x 250GB RAID 0
PSU
500W
Case
Classic black
Cooling
Fans
Keyboard
Microsoft
Mouse
Microsoft
Internet Speed
not bad
Browser
Firefox
Antivirus
Microsoft
Have you checked the storage drivers section? Maybe is not in the BIOS section. Otherwise all you can do, is disable Secure Boot until a newer BIOS, even a Beta version, is released that fixes the issue. At least there is a workaround to use your system.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 23H2 (5699), 25H2 (8737)Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz4GBMobile Intel(R) GMA 4500M (Mobile 4 series)
    OS
    Windows 11 Pro 23H2 (5699), 25H2 (8737)
    Computer type
    Laptop
    Manufacturer/Model
    Acer Extensa 5630EZ
    CPU
    Mobile DualCore Intel Core 2 Duo T7250, 2000 MHz
    Motherboard
    Acer Extensa 5630
    Memory
    4GB
    Graphics Card(s)
    Mobile Intel(R) GMA 4500M (Mobile 4 series)
    Sound Card
    Realtek ALC268 @ Intel 82801IB ICH9 - High Definition Audio Controller
    Monitor(s) Displays
    1
    Screen Resolution
    1280x800
    Hard Drives
    Samsung SSD 850 EVO 250GB SATA Device (250 GB, SATA-III)
    Internet Speed
    VDSL 50 Mbps
    Browser
    MICROSOFT EDGE
    Antivirus
    WINDOWS DEFENDER
    Other Info
    Legacy MBR installation, no TPM, no Secure Boot, no WDDM 2.0 graphics drivers, no SSE4.2, cannot get more unsupported ;) This is only my test laptop. I had installed Windows 11 here before upgrading my main PC. For my main PC I use everyday see my 2nd system specs.

  • At a glance

    Windows 11 Pro v25H2 (build 26200.8737)Intel Core-i7 3770 3.40GHz s1155 (3rd generat...2x Kingston Hyper-X Blu 8GB DDR3-1600GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB...
    Operating System
    Windows 11 Pro v25H2 (build 26200.8737)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom-built PC
    CPU
    Intel Core-i7 3770 3.40GHz s1155 (3rd generation)
    Motherboard
    Asus P8H61 s1155 ATX
    Memory
    2x Kingston Hyper-X Blu 8GB DDR3-1600
    Graphics card(s)
    GIGABYTE GeForce RTX 3050 WINDFORCE OC V2 6GB (GV-N3050WF2OCV2-6GD)
    Sound Card
    Realtek HD audio (ALC887)
    Monitor(s) Displays
    Sony Bravia KDL-19L4000 19" LCD TV via VGA
    Screen Resolution
    1440x900 32-bit 60Hz
    Hard Drives
    WD Blue SA510 2.5 1000GB SSD as system disk, Western Digital Caviar Purple 4TB SATA III (WD40PURZ) as second
    PSU
    Thermaltake Litepower RGB 550W Full Wired
    Case
    SUPERCASE MIDI-TOWER
    Cooling
    Deepcool Gamma Archer CPU cooler, 1x 8cm fan at the back
    Keyboard
    Mitsumi 101-key PS/2
    Mouse
    Sunnyline OptiEye PS/2
    Internet Speed
    100Mbps
    Browser
    Microsoft Edge, Mozilla Firefox
    Antivirus
    Microsoft Windows Defender
    Other Info
    Legacy BIOS (MBR) installation, no TPM, no Secure Boot, WDDM 3.0 graphics drivers, WEI score 7.4
You must log in or register to reply here.

Similar threads

Problems encountered when installing Microsoft CA 2023 certificates on HP products with HP Sure Start
Replies
2
Views
752
suatcini54
suatcini54
Solved Transition to the new Windows UEFI CA 2023 Certificate
Replies
7
Views
11K
Scott
Scott

Latest Support Threads

Latest Tutorials

Back
Top Bottom