Solved garlin's PowerShell scripts for updating Secure Boot CA 2023


phil, the option is urs . do u use secure boot. if you dont use it you have nothing to worry about you pc is not going to die if you dont have the new certs. if you do mess something up. you can just pull your cmos battery and leave it out for a min or so . that will reset it back to default bios. another option if your worried is to make a iso file using rufus and select the ca 2023 cert to automatically burn the image with that file. i used garlin's latest script to update my 14 year old hp to be as they say ready when the time comes. the only thing i had issues with was the powershell commands .But i can say garlins scripts do work.
 

My Computer My Computer

At a glance

WINDOWS 11 WINDOWS 10Intel(R) Core(TM) i7 -3770K CPU 3.50 GZ 3501 ...32.0 GB (31.9 GB usable)AMD RADEON TM R5240 INTELL HD GRAPHICS 4600 T...
OS
WINDOWS 11 WINDOWS 10
Computer type
PC/Desktop
Manufacturer/Model
HP H8 1360T
CPU
Intel(R) Core(TM) i7 -3770K CPU 3.50 GZ 3501 4 CORE
Motherboard
PEGATRON 2AD5
Memory
32.0 GB (31.9 GB usable)
Graphics Card(s)
AMD RADEON TM R5240 INTELL HD GRAPHICS 4600 TIGER 1+1 USB
Sound Card
AMD HD . IDT
Monitor(s) Displays
AOC WAL MART SPECIAL . HP 2311 IX IPS LED DELL 1708 FP
Screen Resolution
1920 X 1080 1600X900 1280X940
Hard Drives
1 FAXING S 100 512GB 1 KINGSTON 120 GB SSD 1 X12 SSD 512 GB
PSU
300 WATT HP
Case
FULL
Cooling
ON BOARD FAN
Keyboard
LOGITEC K 520 WIRELESS
Mouse
LOGITEC M 510 WIRELESS
Internet Speed
55 UP 11.2 DOWN
Browser
CHROME EDGE
Antivirus
WINDOWS SECUIRTY
Other Info
NON SUPPORTED HARDWARE FOR WINDOWS 11
HuntyFtw said:
Thanks for the info. And yes, my PC is in the list, but the updates are spread throughout June and even July for some weird reason.
Click to expand...
Better late than never. If you ever have to reset your BIOS for any reason, it saves you from having to do the manual steps.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garioch7 said:
@garlin ,

My 2019 Dell XPS 8930 SE (last BIOS version 1.31) did not update the Secure Boot with the new certificates after the June Windows Update to 26200.8655) - Computer Specs 1. My 2020 Dell XPS XPS 15 7590 - Computer Spec 2, also not on the supported list for Dell BIOS updates, miraculously, and without notice, did update itself to the new certificates about six weeks ago, according to the Windows Device Security, Secure Boot screen.

It appears that I will have to manually update my 8930 Secure Boot keys. Is this post still the latest and applicable to that computer: How to check if your Secure Boot certs are updated. (three methods)?
Click to expand...
Short answer:

1. Download the scripts from the first post.

2. Run the check script:
Code: 
Check-UEFI.bat  Verbose

3. Post the report output, and we'll help you figure where your XPS 8930 stands right now. The update scripts are designed to handle 3 different scenarios, ranging from ideal to the hardest. But if Dell has pushed either a BIOS update, or submitted a KEK file to MS (easier for them), then your PC may be in a better state.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
jabbado said:
Ok now I'm confused. After mounting the efi partition the certs are there. In the bios I can browse to the cert folder but it shows empty.
Click to expand...
Hey garlin, just letting you know I did some googling about what other file extensions are used for the certs. Decided to try changing the extension to ".cer" to see what would happen and blow me down, they show up in the damn bios when I select "Enroll PEK"! The things you learn :(
 

My Computer My Computer

At a glance

Windows 11Intel i7-10750H
OS
Windows 11
Computer type
Laptop
CPU
Intel i7-10750H
Motherboard
Gigabyte Aorus 5 SB
Did you run the update script? It should add the rest of the CA 2023 certs for you. My experience is most BIOS'es will expect a .der or .crt file, but if it works for you...
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
Did you run the update script? It should add the rest of the CA 2023 certs for you. My experience is most BIOS'es will expect a .der or .crt file, but if it works for you...
Click to expand...
Yes I did that the other day and AFAIK I'm all good. How many certs should there be?
 

My Computer My Computer

At a glance

Windows 11Intel i7-10750H
OS
Windows 11
Computer type
Laptop
CPU
Intel i7-10750H
Motherboard
Gigabyte Aorus 5 SB
jabbado said:
Yes I did that the other day and AFAIK I'm all good. How many certs should there be?
Click to expand...
1x - Platform Key (because it must be unique)
2x - KEK's
5x - DB's
1x - DBX, only if you have revoked CA 2011, otherwise it should be (NONE)

Code: 
UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 8.0
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
That's how mine looks when I run the check script. But I can't see the DBX's due to that exception.

But I only have the 2 KEK's on the efi partition.
 

My Computer My Computer

At a glance

Windows 11Intel i7-10750H
OS
Windows 11
Computer type
Laptop
CPU
Intel i7-10750H
Motherboard
Gigabyte Aorus 5 SB
jabbado said:
That's how mine looks when I run the check script. But I can't see the DBX's due to that exception.

But I only have the 2 KEK's on the efi partition.
Click to expand...
Try this version of the script.
 

Attachments

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
I think it's still the same:

Powershell: 
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    (NONE)
Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string.
Parameter name: startIndex"
At D:\SecureBoot-CA-2023-Updates.v2026.06.08\Check_UEFI-CA2023_new.ps1:772 char:9
+         [version]$SVN = '{0}.{1}' -f [System.Convert]::ToUInt16($Sign ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentOutOfRangeException

So all of those certs/files should be copied to the efi partition?
 

My Computer My Computer

At a glance

Windows 11Intel i7-10750H
OS
Windows 11
Computer type
Laptop
CPU
Intel i7-10750H
Motherboard
Gigabyte Aorus 5 SB
Certs are byte values that are appended to the UEFI variables, they don't live on the EFI volume.

I think I know where the mysterious string error is coming from.
 

Attachments

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Oh I misunderstood. I thought you were saying all the certs, DBX etc should be getting copied to the efi/certs folder

Anyway that script ran without exception:
Powershell: 
Secure Boot: OFF
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    (NONE)

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    [OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.


REQUIRED ACTION
===============
To REVOKE the [PCA 2011] cert, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x282 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

So I'm missing the DBX certs? It shows in the bios as:
dbx_sig.webp

Also, the Update script is now showing a similar exception, which it didn't when I successfully ran it the other day:
Powershell: 
PS D:\SecureBoot-CA-2023-Updates.v2026.06.08> .\Update_UEFI-CA2023.ps1
Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string.
Parameter name: startIndex"
At D:\SecureBoot-CA-2023-Updates.v2026.06.08\Update_UEFI-CA2023.ps1:577 char:5
+     $SVN = '{0}.{1}' -f [System.Convert]::ToUInt16($SignatureData.Sub ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentOutOfRangeException

SUCCESS: NO UPDATES ARE REQUIRED.
 

My Computer My Computer

At a glance

Windows 11Intel i7-10750H
OS
Windows 11
Computer type
Laptop
CPU
Intel i7-10750H
Motherboard
Gigabyte Aorus 5 SB
jabbado said:
Anyway that script ran without exception:
Click to expand...
Finally located the source of the bug...

jabbado said:
Also, the Update script is now showing a similar exception, which it didn't when I successfully ran it the other day:
Powershell: 
PS D:\SecureBoot-CA-2023-Updates.v2026.06.08> .\Update_UEFI-CA2023.ps1
Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string.
Parameter name: startIndex"
At D:\SecureBoot-CA-2023-Updates.v2026.06.08\Update_UEFI-CA2023.ps1:577 char:5
+     $SVN = '{0}.{1}' -f [System.Convert]::ToUInt16($SignatureData.Sub ...
[/QUOTE]
Click to expand...
Fixed the update script.
 

Attachments

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Awesome:
Powershell: 
PS D:\SecureBoot-CA-2023-Updates.v2026.06.08> .\Update_UEFI-CA2023_new.ps1
SUCCESS: NO UPDATES ARE REQUIRED.

But why does the check show:
Powershell: 
UEFI DBX Certs
--------------
    (NONE)
 

My Computer My Computer

At a glance

Windows 11Intel i7-10750H
OS
Windows 11
Computer type
Laptop
CPU
Intel i7-10750H
Motherboard
Gigabyte Aorus 5 SB
You have not revoked the CA 2011 cert, or applied any EFI signatures from the dbxupdate.bin file. If you started by deleting all keys, then DBX would not have any factory defaults for EFI signatures, or any certs.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Oops, done:

Powershell: 
Secure Boot: OFF
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    [OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.


STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

Thank you, garlin!
 

My Computer My Computer

At a glance

Windows 11Intel i7-10750H
OS
Windows 11
Computer type
Laptop
CPU
Intel i7-10750H
Motherboard
Gigabyte Aorus 5 SB
Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is BANNED.

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.


REQUIRED ACTION
===============
To install Windows Boot Manager [UEFI CA 2023], run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
Click to expand...

why do i get "Windows Boot Manager [Windows UEFI CA 2023] is BANNED.", if i try the required action nothing changes ?
what i do see is with the verbose option is,
EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is BANNED.
\\.\HarddiskVolume8\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.322, SVN 8.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.
Click to expand...
i see here SVN 8.0 instead of 9.0, don't know if that has something to do with.
 
Last edited:

My Computer My Computer

At a glance

Win11I7-12700K2x16 DDR5 - 6000 CL36Gigabyte RX 9060 XT 16Gb.
OS
Win11
Computer type
PC/Desktop
Manufacturer/Model
Gigabyte z790 UD AX
CPU
I7-12700K
Motherboard
Gigabyte z790 UD AX
Memory
2x16 DDR5 - 6000 CL36
Graphics Card(s)
Gigabyte RX 9060 XT 16Gb.
Sound Card
Creative Sound BlasterX G6
Monitor(s) Displays
Iiyama G-Master GB2741QSU 144hz
Screen Resolution
2560x1440
PSU
Corsair RM750x
Cooling
Scythe Mugen 6
Keyboard
Corsair K55 RGB Pro XT
Mouse
Logitech G502 Hero
Internet Speed
Fiber 1G 1000/500
Browser
Firefox
garlin said:
But with any crypto tool, you always have ask if your tools are secure. The source code for Mosby is available on GitHub for everyone to examine, but you might need to be a subject matter expert to fully understand the code.
Click to expand...

Seriously? WTF dude.

So a long PowerShell script is not equally cryptic to laymen as C code now?

garlin said:
My approach is to use the MS-provided files, which are provided for PC vendors to use if they like. In my script, it's very transparent where we're downloading the keys from, and how it's installed.
Click to expand...

And it's also SUPER TRANSPARENT in Mosby: Mosby/src/gen_data.sh at main · pbatard/Mosby

We apply the same approach, so, again, I would appreciate if you stopped trying to disparage Mosby at any chance you get.

Yes, our programs are in competition. But that doesn't give you a license to spread FUD.

And I also explained to you that the self signing that Mosby does is no less different than using binaries that have been signed by a third party like an OEM or Microsoft. At the end of the day, the exact same data is applied, and, if you want to go that way, you are a lot less likely to get compromised with files that are self signed on your computer than with something that has been signed by a third party you never actually met (though, again, I have to stress out that in the context of installing Secure Boot certs and databases, it doesn't matter).

garlin said:
You can get into endless arguments over which approach is better (self-signed vs OEM delivery).
Click to expand...

Indeed, it looks like someone really wants to, despite the fact that each approach has its pros and cons and that it should really be to the people to choose, without being bullshitted by someone who has a clear vested interest and will therefore not be impartial about it, as we have repeatedly seen here with such arguments as Open Source C code is somehow less transparent than Open Source PowerShell code.

I'm growing tired of coming back to this thread over and over again, and seeing every mention of Mosby being deprecated by you, as if it was somehow less worthy of use than your script.

We both should want to help people get their certificate upgrade sorted, whichever way they want to do it. That's why we spent time working on our independent solutions. But if this continue, and despite your words that this is indeed what you want, I'm going to have to point out very explicitly that your actions, seemingly every time someone happens to use something else than your script, do not appear to match your words.
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Home Built
Screen Resolution
4k
I don't bring up Mosby on my own, but other people ask me about it. The fundamental difference is you strongly believe in self-signing, and it's a great tool for that but I'm offering an alternative that doesn't go that far to solve the same problem.

You're interpreting my comments as FUD. Have I ever written no one should use Mosby? No. I share my thoughts on its approach and why my script does it differently. It's not to disparage your project, it's more to explain why I chose my direction. Do I get tired of deflecting Mosby questions on a thread dedicated to my scripts, and maybe that tone shows up? Yes.

We can solve this problem if you provide me your preferred contact method for engaging with users when they ask me about Mosby in passing. I will redirect them to where you can directly address their questions and concerns.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
1x - Platform Key (because it must be unique)
2x - KEK's
5x - DB's
1x - DBX, only if you have revoked CA 2011, otherwise it should be (NONE)
Click to expand...
Where do you show the PK, or do you just assume it's there? It's obviously there or the other stuff wouldn't work, is that the working assumption?
 

My Computers My Computers

System One System Two Other systems

  • At a glance

    Win 11 Pro 25H2, Build 26200.8737Intel Core i5 1450064GB DDR4GeForce RTX 4060
    OS
    Win 11 Pro 25H2, Build 26200.8737
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14500
    Motherboard
    Gigabyte B760M G P WIFI
    Memory
    64GB DDR4
    Graphics Card(s)
    GeForce RTX 4060
    Sound Card
    Chipset Realtek
    Monitor(s) Displays
    LG 45" Ultragear, Acer 24" 1080p
    Screen Resolution
    5120x1440, 1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 3D NAND NVMe M.2 SSD (O/S)
    Silicon Power 2TB US75 NVMe PCIe Gen4 M.2 2280 SSD (backup)
    Crucial BX500 2TB 3D NAND (2nd backup)
    Seagate 4TB Ironwolf, rotating HDD archive files
    External off-line backup Drives: 2 NVMe 4TB drives in external enclosures
    PSU
    Thermaltake Toughpower GF3 750W
    Case
    LIAN LI LANCOOL 216 E-ATX PC Case
    Cooling
    Lots of fans!
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security

  • At a glance

    Win 11 Pro 25H2, Build 26200.8655Intel Core i5 1440032GB DDR5Intel 700 Embedded GPU
    Operating System
    Win 11 Pro 25H2, Build 26200.8655
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14400
    Motherboard
    Gigabyte B760M DS3H AX
    Memory
    32GB DDR5
    Graphics card(s)
    Intel 700 Embedded GPU
    Sound Card
    Realtek Embedded
    Monitor(s) Displays
    27" HP 1080p
    Screen Resolution
    1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 eD NAND PCIe SSD
    Samsung EVO 990 2TB NVMe Gen4 SSD
    Samsung 2TB SATA SSD
    PSU
    Thermaltake Smart BM3 650W
    Case
    Okinos Micro ATX Case
    Cooling
    Fans
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security
  • Nimo N171 17" Laptop, (Intel i3-1215U, 16GB RAM, 2TB NVMe, Win11 Pro)
    Acemagic Vista Mini PC V1 (Intel N150, 16GB RAM, 1TB NVMe, Win11 Pro)
    HP ENVY h8-1540t, (24GB RAM, 2TB SSD, 2TB HDD, Win11 Pro)
You must log in or register to reply here.

Latest Support Threads

Latest Tutorials

Back
Top Bottom