Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

JamesSmith · Apr 16, 2026

garlin said:
EVERYONE ELSE: You really don't need to follow this step.

Come to think of it.

Since this has been written in BIG RED BOLD Letters I can’t tell if this command is a good idea to run.

I know it’s going to fill the missing dbx signatures and help my OCD but is there something it may break? That big red warning is concerning.

I just want everyone to be happy.

gunrunnerjohn · Apr 16, 2026

garlin said:
This will invalidate most of the wrong wisdom on the webs right now. There has never been a "correct" number.

Gee, I can only hope that Microsoft is paying you for all the work you've done for them! :clap:

garlin · Apr 16, 2026

GunnzAkimbo said:
UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN is MISSING.
EFI_CERT_SHA256_GUID Signatures: 432

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume2\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.322, SVN 8.0

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

SkuSiPolicy.p7b (for VBS) is MISSING. [OPTIONAL]

AUDIT REPORT
============
1. [Production PCA 2011] is missing from UEFI DBX
2. Windows BootMgr SVN is missing from UEFI DBX
3. SkuSiPolicy.p7b (for VBS) is missing [OPTIONAL]

You have the CA 2023 certs, but haven't revoked anything yet (DBX).

mazzutti74 · Apr 16, 2026

Hello
I have a Samsung Galaxy Book 2 notebook. The last BIOS update was in April 2025. Here are images of my BIOS.

In the event viewer I have error 1801: Updated Secure Boot certificates are available on this device, but have not yet been applied to the firmware. Review the published guidelines to complete the update and maintain full protection. Error 1797: The Secure Boot update failed because the Windows UEFI CA 2023 certificate is not present in the Db. Error 1802: The Secure Boot KEK 2023 update was blocked due to a known firmware issue on the device.

In this scenario, do I have to do it manually? I don't think I'll get another BIOS update for my machine. Thank you.

garlin · Apr 16, 2026

You have a KEK Management screen, which means you can try manual key enrollment.

1. Download the KEK CA 2023 cert file from MS's GitHub:
secureboot_objects/PreSignedObjects/KEK/Certificates/microsoft corporation kek 2k ca 2023.der at main · microsoft/secureboot_objects

2. Copy it to your EFI partition:

Code:

mountvol S: /s
mkdir S:\EFI\certs
copy "microsoft corporation kek 2k ca 2023.der" S:\EFI\certs

3. Shutdown Windows. Enter BIOS and return to the first screen.

4. Enter KEK Management. You should have an option to load a key from a file. Browse the EFI partition (you may have to guess which device is your system disk, and look for the EFI\Certs folder.

5. Load the file. If successful, reboot into Windows and run the update script.

mx101 · Apr 16, 2026

I've tried everything, but I keep getting these errors

Code:

SUCCESS: Matched 278/278 EFI signatures from "dbxupdate.bin"
No EFI_CERT_SHA256 signatures in C:\Windows\System32\SecureBootUpdates\DBXUpdate2024.bin
No EFI_CERT_SHA256 signatures in C:\Windows\System32\SecureBootUpdates\DBXUpdate2024Legacy.bin
SUCCESS: Matched 278/278 EFI signatures from "dbxupdateLegacy.bin"
FAILED: Missing 3/3 SVN signatures from "DBXUpdateSVN.bin"
FAILED: Missing 3/3 SVN signatures from "DBXUpdateSVNLegacy.bin"

second error:

Code:

PowerShell 7.6.0
Secure Boot: OFF
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    (NONE)

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b (for VBS) is MISSING. [OPTIONAL]


REQUIRED ACTION
===============

Run the command:
    Update_UEFI-CA2023.ps1 -Revoke

Finish the UEFI steps to manually add the [KEK CA 2023] cert, if the script provided instructions.

PS C:\Users\xxx\Desktop\SecureBoot-CA-2023-Updates2> .\Update_UEFI-CA2023.ps1 -Revoke
ERROR: Failed to append "DBXUpdate2024.bin" to UEFI DBX.
Wrong signature for this UEFI variable.

garlin · Apr 16, 2026

mx101 said:

I've tried everything, but I keep getting these errors

Code:

SUCCESS: Matched 278/278 EFI signatures from "dbxupdate.bin"
No EFI_CERT_SHA256 signatures in C:\Windows\System32\SecureBootUpdates\DBXUpdate2024.bin
No EFI_CERT_SHA256 signatures in C:\Windows\System32\SecureBootUpdates\DBXUpdate2024Legacy.bin
FAILED: Missing 3/3 SVN signatures from "DBXUpdateSVNLegacy.bin"

A newer version of the DBXUpdate2024.bin was pushed in the Apr 2026, I'm beginning to suspect it's a corrupted file.

mx101 said:

second error:

Code:

PowerShell 7.6.0
Secure Boot: OFF
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
[/QUOTE]
You're missing the specific KEK CA 2023 for your BIOS.  What model PC do you have?

[QUOTE="mx101, post: 731027, member: 11617"]
PS C:\Users\xxx\Desktop\SecureBoot-CA-2023-Updates2> .\Update_UEFI-CA2023.ps1 -Revoke
ERROR: Failed to append "DBXUpdate2024.bin" to UEFI DBX.
Wrong signature for this UEFI variable.

I would worry about the missing KEK first. Without it, you're stuck. Check if there's a newer BIOS available, which might have the certs built-in.

mx101 · Apr 16, 2026

No newer BIOS available

garlin · Apr 16, 2026

What's the PC model? You can check if your PC supports manual key enrollment for Secure Boot certs. Otherwise you may need to wipe the factory certs and go into Setup mode.

Bree · Apr 16, 2026

garlin said:
You have a KEK Management screen, which means you can try manual key enrolment......

You help has been invaluable to me, though perhaps not in the way you might think.

I have (or rather had) a Dell Latitude E7440 on which I practised the manual updating. I got as far as the KEK CA 2023 certificate before I hit an obstacle. It's bios management refused to accept the KEK CA 2023 certificate whatever I did. I solved the dilemma by selling on that laptop and letting someone else deal with it

My remaining Dells have all been updated to 2023 certs without any effort on my part, all through Windows Update (including the Dell bios). Your scripts confirm that the only thing left to do is revocation, which I think I'll wait and let MS do that.

So thanks for helping me cull my collection of laptops down to just the ones that can get the 2023 certs automatically

mx101 · Apr 16, 2026

garlin said:
What's the PC model? You can check if your PC supports manual key enrollment for Secure Boot certs. Otherwise you may need to wipe the factory certs and go into Setup mode.

acer nitro 5 an515-55 notebook and don't support key enrrollment

garlin · Apr 16, 2026

Bree said:
I have (or rather had) a Dell Latitude E7440 on which I practised the manual updating. I got as far as the KEK CA 2023 certificate before I hit an obstacle. It's bios management refused to accept the KEK CA 2023 certificate whatever I did. I solved the dilemma by selling on that laptop and letting someone else deal with it

My remaining Dells have all been updated to 2023 certs without any effort on my part, all through Windows Update (including the Dell bios). Your scripts confirm that the only thing left to do is revocation, which I think I'll wait and let MS do that.

Unlike other OEM's, Dell's can only use an .auth file for key management.

The .auth format has additional security because it requires you sign the cert with a personal key. At that point, you're doing what Mosby does. My approach is to keep the update process as close to the original certs as possible. Barring the use of .auth files, the alternative on older Dells without a BIOS update is to use Setup mode (wiping the factory certs).

MS anticipated problems like this, and provided their own Windows OEM Devices certs as a drop-in replacement for Setup mode.

garlin · Apr 16, 2026

mx101 said:
acer nitro 5 an515-55 notebook and don't support key enrrollment

What you need to do:
1. Disable Secure Boot mode.
2. Select Custom mode.
3. Find the Delete all keys option.
4. Restart Windows, and run the update script. It should recognize you're in Setup mode and write the Windows OEM Devices PK certs as a replacement. Now you have a MS-provided set of certs that was made for situations like yours.

mx101 · Apr 16, 2026

garlin said:
What you need to do:
1. Disable Secure Boot mode.
2. Select Custom mode.
3. Find the Delete all keys option.
4. Restart Windows, and run the update script. It should recognize you're in Setup mode and write the Windows OEM Devices PK certs as a replacement. Now you have a MS-provided set of certs that was made for situations like yours.

I don't have option for custom mode and I've already done the other steps several times "delete all keys" include.

With no results.

garlin · Apr 16, 2026

If you've deleted all keys, the update script should install certs for you (including the missing KEK CA 2023). What's the output from the update script?

mx101 · Apr 16, 2026

garlin said:
If you've deleted all keys, the update script should install certs for you (including the missing KEK CA 2023). What's the output from the update script?

to restart the windows and read the "README_UEFI.txt", but after restart the windows nothing change, my secure boot say that I have an old certificate.

garlin · Apr 16, 2026

If you have correctly cleared the old certs, then the check script will report you're in Setup mode.

https://www.reddit.com/r/AcerOfficial/comments/1sbkprx/secure_boot_mode

mazzutti74 · Apr 16, 2026

Set new KEK or Append Var to KEK?
input file format? which one

mx101 · Apr 16, 2026

@garlin I've already done these I don't have option for custom mode

the only option I've is enable or disable the secure boot is always on "UEFI mode", I can only enable or disable.

t2s50 · Apr 16, 2026

I wonder a little bit why your script proposes to revoke the PCA2011 cert while it lists the PCA2011 already in the dbx? (Read the latest posts and didn't find that covered. Did I overlook something?)

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

New member

Attachments

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

New member

Attachments

My Computer

Well-known member

My Computer

Member

Attachments

My Computer