Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

suatcini54 · 2026-08-02T09:37:54-0400

XxXxX said:
this maybe of help for those with Nvidia cards

GPU & AI FAQ: Expert Answers - Massed Compute

Answers to common questions on NVIDIA GPUs, CUDA, machine learning, and HPC. Browse practical, expert-level explanations or ask your own question.

massedcompute.com

you are most likely going to need a BIOS or firmware update for Nvidia GPU's for them to boot with the new windows secure boot certs

Download The Latest Official NVIDIA Drivers

Download the latest official NVIDIA drivers to enhance your PC gaming experience and run apps faster.

www.nvidia.com

if they have any available.
best of luck Steve ..

Thanks for this information. Unfortunately, my gfx card is out of support and there is no firmware update nor a new driver update to insert new certificates into the gfx card.

If my memory serves me well, I remember @garlin gave me a link where firmware of gfx cards was modified for compatibility of new certificates but modifying firmware of my card using hex editors and such is too complex a process for me to carry out without a possible bricking of the card.

Thanks anyway.

Have a nice weekend.

garlin · 2026-08-02T10:11:48-0400

suatcini54 said:
When I run the Secure Boot check certificates script, I get this result in AUDIT REPORT section:

To make sure you have the latest boot manager, there is a check for your Windows build version. In the script, it's any Windows that is updated to June 2026 or later. But here's a major problem: unlike other folks, I don't have time to install all the different Insider or Preview builds.

Some of the Insider builds aren't always in sync with Secure Boot update files (slightly behind).

There isn't a published table of all of the Insider or Preview builds by date, so you can determine when that build was released. For production Windows, MS provides the Windows Update History and it lists every update by build and release date. Since I'm not going to spend my entire week looking at random pre-release builds, I wait until Patch Tuesday to determine if the Windows build check needs to be updating. For some months, nothing major happens with the Secure Boot files.

Any Windows that is higher than the Production channels will be marked "Cannot confirm if [X] has the latest file".

suatcini54 said:
When I run the commands in REQUIRED ACTION section and, after restarting I re-check the certificates status, I get the same result. Nothing changes.

What is the version of C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi?
Run the PS command: Get-SecureBootSVN

suatcini54 · 2026-08-02T10:45:40-0400

Sorry @garlin My post was intended for informational purposes only.

But now you ask, please find the info below:

Thanks. Edit: This is build 26300.9032 (26H2)

garlin · 2026-08-02T10:55:06-0400

Are these two results the same?

Code:

Get-FileHash \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
Get-FileHash C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi

suatcini54 · 2026-08-02T11:06:19-0400

No. They are different.

anchamp65 · 2026-08-02T11:26:38-0400

fernando BARBA said:
*******************************
thank you, Scott
yes, the ASUS have another, (than the own NVIDIA card), HDMI port which i guess is an input only port and a VGA port which implies that i´d need an adapter VGA/HDMI as my monitor only has a HDMI and DISPLAY PORT inputs...,
fernando

With your previous post, I though there was no ports (HDMI, DP or VGA) on the back.
I would simply try it and see !
Remove the NVidia card, plug your monitor to the onboard HDMI port and see if you get a display.
My guess is that's an onboard integrated graphics card, but let's try it out and see...

Do you remember if you ever went to the BIOS to tell it to only use the PCI graphics card.
If you don't get a display with the onboard port, put back the NVidia and check the BIOS to see if it's configure to only use the PCI one.

garlin · 2026-08-02T11:51:41-0400

suatcini54 said:
No. They are different.

The script checks if the EFI boot manager is:

- Windows UEFI CA 2023

- has the same SVN or higher

- has the same file hash as the \Windows\Boot\EFI_EX version (so I don't have to perform a file compare)

Like I said before, Insider and Preview releases aren't always in sync with updates because they are not production releases. Why does this build have a differently compiled boot manager with the same version and SVN? I have no idea.

suatcini54 · 2026-08-02T12:03:41-0400

Thanks @garlin . This info is satisfactory for me. After a few months when 26H2 is out of experimental preview, we will know.

Have a nice weekend.

gunrunnerjohn · 2026-08-02T12:35:52-0400

fernando BARBA said:
*******************************
thank you, Scott
yes, the ASUS have another, (than the own NVIDIA card), HDMI port which i guess is an input only port and a VGA port which implies that i´d need an adapter VGA/HDMI as my monitor only has a HDMI and DISPLAY PORT inputs...,
fernando

I doubt you have an input HDMI port on your motherboard, that's an output from the embedded motherboard GPU.

fernando BARBA · 2026-08-02T17:23:43-0400

anchamp65 said:
With your previous post, I though there was no ports (HDMI, DP or VGA) on the back.
I would simply try it and see !
Remove the NVidia card, plug your monitor to the onboard HDMI port and see if you get a display.
My guess is that's an onboard integrated graphics card, but let's try it out and see...

Do you remember if you ever went to the BIOS to tell it to only use the PCI graphics card.
If you don't get a display with the onboard port, put back the NVidia and check the BIOS to see if it's configure to only use the PCI one.

********************************************************************************
Scott said:

A third option is to switch to integrated graphics, which your CPU supports.

************************************************
thank you, anchamp65 and Scott
yes, it seems you are right; i will try that when possible and report the result,
fernando

fernando BARBA · 2026-08-02T17:27:29-0400

gunrunnerjohn said:
I doubt you have an input HDMI port on your motherboard, that's an output from the embedded motherboard GPU.

**************
hello, gunrunnerjohn
indeed, i think you´re right; i will try that HDMI port-------- thank you,
fernando

Capricornus · 2026-08-03T03:32:26-0400

My HP Z440 workstation and my graphics card: at the moment I am very confused about needing a CA 2023 cert on my graphics card (GOP part of the VBIOS) or not.

At the moment I have the following situation:
The HP Z440 UEFI has the CA 2023 cert, and works well.
The graphics card (GOP) has the CA 2011 cert.
I revoked the CA 2011 in the UEFI weeks ago, but my graphics card still works. The script clearly says: CA 2011 revoked, as you can see below

PS C:\Users\admin\Downloads\SecureBoot-CA-2023-Updates.v2026.07.28> .\check-UEFI.bat -Verbose
PowerShell 7.6.4
Windows 11 25H2 (26200.8973)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
Hewlett-Packard HP Z440 Workstation
Version: M60 v02.62
Date: 2024-01-04

Factory Default UEFI PK Cert
----------------------------
Hewlett-Packard UEFI Secure Boot Platform Key

UEFI PK Cert
------------
Hewlett-Packard UEFI Secure Boot Platform Key

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Hewlett-Packard UEFI Secure Boot Key Exchange Key

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023
Hewlett-Packard UEFI Secure Boot Key Exchange Key

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Hewlett-Packard UEFI Secure Boot DB Key

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023
Hewlett-Packard UEFI Secure Boot DB Key
HP UEFI Secure Boot 2013 DB key

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 14

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0
EFI_CERT_SHA256_GUID Signatures: 298

UEFI Variables
--------------
Credential Guard: ON
SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\Users\admin\Downloads\SecureBoot-CA-2023-Updates.v2026.07.28>

But, if the CA 2011 is revoked, the graphics card should not work anymore, or should it?

Reading this thread:

https://www.reddit.com/r/gigabyte/comments/1su253l/nvidia_rtx_gpu_and_vbios_support_ca_2023_for

some users say it is not important what cert you have on the graphics card.

Is it possible that, because of limited or bad or not strict implementation, some systems only validate the certs of the UEFI, but not the GOP cert on the graphics card?
Otherwise, I do not understand why my HP Z440 works with my old Nvidia K2200 graphics card, and with the CA 2011 revoked in the UEFI.

itsme1 · 2026-08-03T04:05:39-0400

Capricornus said:
My HP Z440 workstation and my graphics card: at the moment I am very confused about needing a CA 2023 cert on my graphics card (GOP part of the VBIOS) or not.

At the moment I have the following situation:
The HP Z440 UEFI has the CA 2023 cert, and works well.
The graphics card (GOP) has the CA 2011 cert.
I revoked the CA 2011 in the UEFI weeks ago, but my graphics card still works. The script clearly says: CA 2011 revoked, as you can see below

PS C:\Users\admin\Downloads\SecureBoot-CA-2023-Updates.v2026.07.28> .\check-UEFI.bat -Verbose
PowerShell 7.6.4
Windows 11 25H2 (26200.8973)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
Hewlett-Packard HP Z440 Workstation
Version: M60 v02.62
Date: 2024-01-04

Factory Default UEFI PK Cert
----------------------------
Hewlett-Packard UEFI Secure Boot Platform Key

UEFI PK Cert
------------
Hewlett-Packard UEFI Secure Boot Platform Key

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Hewlett-Packard UEFI Secure Boot Key Exchange Key

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023
Hewlett-Packard UEFI Secure Boot Key Exchange Key

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Hewlett-Packard UEFI Secure Boot DB Key

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023
Hewlett-Packard UEFI Secure Boot DB Key
HP UEFI Secure Boot 2013 DB key

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 14

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0
EFI_CERT_SHA256_GUID Signatures: 298

UEFI Variables
--------------
Credential Guard: ON
SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\Users\admin\Downloads\SecureBoot-CA-2023-Updates.v2026.07.28>

But, if the CA 2011 is revoked, the graphics card should not work anymore, or should it?

Reading this thread:

https://www.reddit.com/r/gigabyte/comments/1su253l/nvidia_rtx_gpu_and_vbios_support_ca_2023_for
some users say it is not important what cert you have on the graphics card.

Is it possible that, because of limited or bad or not strict implementation, some systems only validate the certs of the UEFI, but not the GOP cert on the graphics card?
Otherwise, I do not understand why my HP Z440 works with my old Nvidia K2200 graphics card, and with the CA 2011 revoked in the UEFI.

The only certificate that needs to be revoked is the Microsoft Windows Production PCA 2011 certificate, and you have revoked it.

This certificate is only used for Windows, not for graphics cards.
The other certificates will expire, I'm sure of that, and without being revoked I think. It is when they expire that issues could arise for graphics cards.

I believe that the nvidia 4000 series graphics cards use a 2011 certificate, so nvidia should move to update the GOP, I think, but whether they will do it for all GPU series is not certain.

Capricornus · 2026-08-03T04:24:02-0400

itsme1 said:
The only certificate that needs to be revoked is the Microsoft Windows Production PCA 2011 certificate, and you have revoked it.

This certificate is only used for Windows, not for graphics cards.
The other certificates will expire, I'm sure of that, and without being revoked I think. It is when they expire that issues could arise for graphics cards.

I believe that the nvidia 4000 series graphics cards use a 2011 certificate, so nvidia should move to update the GOP, I think, but whether they will do it for all GPU series is not certain.

Ah...that makes sense to me. And no, nvidia will never update the Quadro K2200 graphics cards. They are far too old.

So, secure boot will need to be disabled before Oct 2026.

I am not going to invest anymore in the HP Z440. I would need to swap the power supply, and the graphics card. It is simply too much money for a 10-year old system. A pity, as this system has served me well. I bought it second-hand in 2020 for a very good price.
And expecting a financial bonus sometime at the start of 2027, I wll be able to buy another computer.

Scott · 2026-08-03T04:43:02-0400

Capricornus said:
Otherwise, I do not understand why my HP Z440 works with my old Nvidia K2200 graphics card, and with the CA 2011 revoked in the UEFI.

itsme1 said:
The only certificate that needs to be revoked is the Microsoft Windows Production PCA 2011 certificate, and you have revoked it.

Someday these two will expire and be revoked. We'll see what happens then.

itsme1 · 2026-08-03T05:20:21-0400

I have a GTX 1060 in my laptop. I’m waiting and hoping it won’t be abandoned. :crossed

Warre1 · 2026-08-03T06:27:31-0400

Just because they expire doesn't mean they are revoked

nikki605 · 2026-08-03T08:15:13-0400

anchamp65 said:
ok, but did you retry Garlin's command in it or any other that you now have ?

Doesn't look good.

gunrunnerjohn · 2026-08-03T10:09:32-0400

I have the nVidia RTX 4060, it's starting to sound like I'm about to run into issues with Secure Boot.

garlin · 2026-08-03T11:03:07-0400

The more I read those NVIDIA threads, the more I'm confused. Are other people online just wrong, and confused and spreading FUD? Because most of them don't sound very technical, like they can't even explain how the whole thing works.

1. Secure Boot mode requires full UEFI mode, no CSM support.
2. Secure Boot can require a signed ROM, if your GPU has to work with the UEFI during the power on state (GOP) before you boot an OS.
3. MS wants everyone to ban Windows PCA 2011. There is no requirement to ban Microsoft UEFI CA 2011.
4. Expired certs don't brick the UEFI. Once a cert is enrolled in the UEFI variables, it's forever trusted unless it's explicitly banned.
5. This would be trivial to test by rolling the BIOS clock forward to past the expiration date.
6. If this issue was so serious, why hasn't NVIDIA published any advisory, since they've had a couple of years in advance of 2026 to get ready?

Are we really here because people don't know to make a solid test case?
Are people confusing Secure Boot (with no CSM) with cert expiration/banning?

NVIDIA is the biggest player in the GPU market. If this was such a crippling concern, why isn't there a Secure Boot campaign like what MS is doing? Or why doesn't MS bother to check if you have an impacted GPU before running the Secure Boot task? :think:

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer