Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · Apr 10, 2026

When you have a Platform Key installed, your OS cannot delete any existing DB or DBX cert as a security measure. They can only add new certs (if properly signed). You can only delete certs by hand from the UEFI setup screens.

If you don't remember removing it, the most likely explanation is your PC shipped that way.

Forestlander · Apr 10, 2026

Well, I’m using a Samsung Galaxy Book laptop, and before installing Windows 11 Pro (February ISO), I completely cleaned everything via UEFI — including TPM, storage, and Intel CSME (unconfigured and sanitized/purged).
So the SSD was completely clean, with no Samsung recovery partition or any bloatware left.

That’s probably the reason.

neldog · Apr 10, 2026

garlin said:
Are you using Windows Hello? If not, it should be 0 (users). Again, it only matters for users who can't do updates other than by using Setup Mode. If you're already updated or you have a supported PC, there's no need to think about Windows Hello.

No, not using Hello, so the results I got (0) and that would be correct. Sorry for the confusion. I was trying to say I got a "0" and that would be correct as I do not use Hello. I was not worried about the Hello, I was just letting you know the command worked here. Thank you.

gunrunnerjohn · Apr 10, 2026

As I recall, when I updated all my keys a few months ago and moved to the 2023 cert, the setup did remove my PIN. However, I just used the password to login and setup the PIN again.

dreamer29 · Apr 10, 2026

Hello everyone I need help, what do I have to do? I have an Acer Nitro 5 AN517-52 gaming laptop.

garlin · Apr 10, 2026

Your PC is missing the KEK CA 2023 cert.
Please shutdown Windows, and temporarily disable Secure Boot mode in BIOS (so you can boot again).

The last BIOS was Oct. 2022, which is too old. While you're in the BIOS, check if you have a UEFI menu screen with manual key enrollment. There might be an option to load a key file. If you find that option for the KEK key, browse the system disk and check if there's a \EFI\Certs folder with a KEK file inside.

Presuming you don't have a manual key enrollment option, or the import fails, you will need to look for "Custom mode". Select Custom mode, and search for an option to Delete All Keys. This will clear all the keys and your BIOS will be in Setup mode (no certs).

With Secure Boot disabled, boot in Windows. Run the update script, it should recognize you're in Setup Mode and replace all the certs for you. Try the manual key enrollment first, and only pick Custom mode/delete keys as the last option.

dreamer29 · Apr 10, 2026

This is my BIOS menu. I couldn't find anything for key enrollment. The BIOS is in German; I don't know if you can still read everything there.

dreamer29 · Apr 10, 2026

Bios in english

garlin · Apr 10, 2026

Thanks. --> "Erase all Secure Boot Setting". It should change Secure Boot Mode from "Standard" to "Custom".

Before you erase the certs, please check if you are using a Hello PIN for Windows logon. The PIN will stop working, so you should disable the PIN in Windows before wiping the certs. If you don't use Hello PIN, then erase now.

Boot into Windows, and run the update script.

dreamer29 · Apr 10, 2026

what i need to do?

dreamer29 · Apr 10, 2026

and now ?

garlin · Apr 10, 2026

Run the check script, you should have:
- 2 KEK certs
- 5 DB certs
- 0 DBX certs (not revoked yet)

dreamer29 · Apr 10, 2026

so i check it

garlin · Apr 10, 2026

I'm not sure why the SVN parsing is broken for your UEFI. But you've added all the CA 2023 certs, and you can revoke the PCA 2011 cert now or wait for Windows later this summer.

If you want to revoke now, you can re-run the update script:

Code:

Update_UEFI-CA2023.ps1 -Revoke

dreamer29 · Apr 10, 2026

garlin said:
I'm not sure why the SVN parsing is broken for your UEFI. But you've added all the CA 2023 certs, and you can revoke the PCA 2011 cert now or wait for Windows later this summer.

If you want to revoke now, you can re-run the update script:

Code:

Update_UEFI-CA2023.ps1 -Revoke

Will this cause me any problems? Or am I still protected?And can I reactivate Secure Boot now?

garlin · Apr 10, 2026

Revoking PCA 2011 now means you need to check a;l bootable USB drives (like a Windows ISO or recovery drive), and replace the boot files. Otherwise they may still have the banned CA 2011 version and not CA 2023.

The worse case if you didn't update them is to temporarily disable Secure Boot and use the untouched drives. When you're finished , switch Secure Boot back on. Or replace the boot files when you have time.

The script can replace the boot file on any removable USB media.

Code:

Update_UEFI-CA2023.ps1 -BootMedia

It should be safe to re-enable Secure Boot.

dreamer29 · Apr 10, 2026

Okay, maybe I'll do that later with the boot files. Could you tell me if everything is okay here? It says updated, but what about the other registry entries?

garlin · Apr 10, 2026

dreamer29 said:
Okay, maybe I'll do that later with the boot files. Could you tell me if everything is okay here? It says updated, but what about the other registry entries?

Trust the check script's report, instead of trying to decode the reg key details.
Most of the error data is because Windows's Secure Boot task failed in its attempt to update your unsupported BIOS.

ConfidenceLevel - MS hasn't found enough users with your exact motherboard/model & BIOS version to decide if updates will be successful. If you don't own a more popular PC model, there may not be enough data samples collected to reach a good confidence level.

KEKLastUpdateError - Secure Boot task cannot perform a manual KEK enrollment or reset into Setup Mode. Therefore it failed.

KEKLastUpdateErrorReason - Acer never signed a KEK CA 2023 for this model. You must use the Windows OEM Devices PK set of certs as a replacement.

dreamer29 · Apr 11, 2026

garlin said:
Trust the check script's report, instead of trying to decode the reg key details.
Most of the error data is because Windows's Secure Boot task failed in its attempt to update your unsupported BIOS.

ConfidenceLevel - MS hasn't found enough users with your exact motherboard/model & BIOS version to decide if updates will be successful. If you don't own a more popular PC model, there may not be enough data samples collected to reach a good confidence level.

KEKLastUpdateError - Secure Boot task cannot perform a manual KEK enrollment or reset into Setup Mode. Therefore it failed.

KEKLastUpdateErrorReason - Acer never signed a KEK CA 2023 for this model. You must use the Windows OEM Devices PK set of certs as a replacement.

thanks for your help

gunrunnerjohn · Apr 11, 2026

garlin said:
The script can replace the boot file on any removable USB media.

Code:

Update_UEFI-CA2023.ps1 -BootMedia

Is this still limited to things like Windows recovery disks, etc.? I believe you mentioned in the past that it can't deal with non-standard boot disks that have their files in other locations?

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers