Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin said:

@wabbit I fixed your Rufus issue (same problem as Ventoy).

While the signing cert passed the sanity check, it failed the SVN test (since 3rd-party boot loaders have SVN = 0.0). I had to put special handling for non-Windows boot loaders.

Code:

USB Drive D: "ESD-ISO"
    Boot File [Microsoft Corporation UEFI CA 2011] is ALLOWED.
        D:\EFI\Boot\bootx64.efi
        [THIRD-PARTY] EFI File

Click to expand...

I think we got it this time:

USB Drive E: "RUFUS_BOOT"
Boot File [Microsoft Corporation UEFI CA 2011] is ALLOWED.
E:\EFI\Boot\bootx64.efi
[THIRD-PARTY] EFI File

wabbit said:

If this help, the properties window of the efi file:
View attachment 178936

Click to expand...

if you or anybody else wishes to update the secure boot certs for the system manually please try this link

best of luck Steve ..

And this is what I get, when I check a normal recovery drive USB-Stick, made with the recovery drive tool of windows 11 on my HP Z440 workstation, and using the check_media.ps1 in post 3,199:
PS C:\Users\admin\Downloads\SecureBoot-CA-2023-Updates.v2026.08.08> .\Check-Bootmedia.bat -Verbose
PowerShell 7.6.4
Windows 11 25H2 (26200.8973)

Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

Bootable Media
--------------

USB Drive J: "REINER-SCT"

USB Drive I: "RECOVERY"
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
I:\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.352, SVN 9.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.8875


PS C:\Users\admin\Downloads\SecureBoot-CA-2023-Updates.v2026.08.08>


And the rufus-made, install windows 11 USB-stick gives this:

PS C:\Users\admin\Downloads\SecureBoot-CA-2023-Updates.v2026.08.08> .\Check-Bootmedia.bat -Verbose
PowerShell 7.6.4
Windows 11 25H2 (26200.8973)

Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

Bootable Media
--------------

USB Drive K: "Win11_25H2_EngUS_x64_18July2026"
Boot File [Windows UEFI CA 2023] is ALLOWED.
K:\EFI\Boot\bootx64.efi
File Version: 28000.352, SVN 9.0

boot.wim:2 (WinPE 26100.8873)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.352, SVN 9.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.8870

K:\EFI\Microsoft\Boot\boot.stl [18/05/2026 19:44] is CURRENT.

install.esd:1 (W11 25H2 26200.8873)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.352, SVN 9.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.8870

Skipping over the next 6 images.

USB Drive J: "REINER-SCT"

USB Drive I: "RUFUS_BOOT"
Boot File [Microsoft Corporation UEFI CA 2011] is ALLOWED.
I:\EFI\Boot\bootx64.efi
[THIRD-PARTY] EFI File


PS C:\Users\admin\Downloads\SecureBoot-CA-2023-Updates.v2026.08.08>

The results from the latest Check_BootMedia.ps1 are all good with HBS USB & Ventoy, but not with an old Rufus created Win11 USB as drive F:

Bootable Media
--------------
Check-DriveVolume : Cannot bind argument to parameter 'DriveLetter' because it is an empty string.
At E:\Garlin\Check_BootMedia.ps1:2352 char:52
+ Check-DriveVolume -DriveLetter $Drive
+ ~~~~~~
+ CategoryInfo : InvalidData: (:) [Check-DriveVolume], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Check-DriveVolume

That's what I get on audit:

"UEFICA2023Status" = Updated SUCCESS: UPDATES ARE FINISHED. UEFI CA 2023 certs are present, PCA 2011 cert is revoked

However, get-tpm command still returns me RestartPending: True.

Also, in Event Viewer I get the same error SubmitV2Attestation: Bad Request
{"Message":"V2 Protocol AIK certificate requests with P-256 ECC public keys are not supported. Public key algorithm: 1.2.840.10045.2.1, Key length: 256."}

I guess there's nothing more I can do on my side? According to provided scripts and audit it's all fine. In BIOS I set SecureBoot to Standard (instead of Custom which was there for some reason). I get zero other issues upon check-up.

Here's the latest test version.

XxXxX said:

Windows Secure Boot Key Creation and Management Guidance

Windows Secure Boot Key Creation and Management Guidance

learn.microsoft.com

Click to expand...

That's probably Garlin's bedside reading !
Correction, he can probably recite it by memory !

blownwiththeWin said:

However, get-tpm command still returns me RestartPending: True.

Also, in Event Viewer I get the same error SubmitV2Attestation: Bad Request
{"Message":"V2 Protocol AIK certificate requests with P-256 ECC public keys are not supported. Public key algorithm: 1.2.840.10045.2.1, Key length: 256."}

I guess there's nothing more I can do on my side? According to provided scripts and audit it's all fine. In BIOS I set SecureBoot to Standard (instead of Custom which was there for some reason). I get zero other issues upon check-up.

Click to expand...

TPM errors are unrelated to Secure Boot certs. Windows will post Secure Boot events through the TPM-WMI logging channel, because there isn't a separate channel for itself.

I suspect you're also getting the Event 87 SCEP errors which started after last month's update. This is an ongoing issue that a lot of users are reporting, which will probably require a BIOS or Windows fix.

anchamp65 said:

Correction, he can probably recite it by memory !

Click to expand...

The shared article in question is a technical guide for OEM's. It contains no practical instructions for end-users. Some Secure Boot references mostly talk about what the keys are, how they're suppose to work, but don't actually go into the actual deployment or verification.

The only handy feature about the page is MS provides download links for the cert files, in case you want to do manual enrollment.

garlin said:

TPM errors are unrelated to Secure Boot certs. Windows will post Secure Boot events through the TPM-WMI logging channel, because there isn't a separate channel for itself.

I suspect you're also getting the Event 87 SCEP errors which started after last month's update. This is an ongoing issue that a lot of users are reporting, which will probably require a BIOS or Windows fix.

Click to expand...

Yes you're right, i get this errors as users are reporting. However I thought it was related to old certificate revoke or smth. Since I used suggested tools to fix all issues but still got this errors, I thought it's still something on my side. But I guess I will just wait for Microsoft to fix this.

garlin said:

The shared article in question is a technical guide for OEM's. It contains no practical instructions for end-users. Some Secure Boot references mostly talk about what the keys are, how they're suppose to work, but don't actually go into the actual deployment or verification.

The only handy feature about the page is MS provides download links for the cert files, in case you want to do manual enrollment.

Click to expand...

It was obviously a joke, I have no intention of getting into building my own certificates.
And if I need any info or guidance on Secure Boot certificates, I use this web site: Complete Guide on Secure Boot

Just for the reference. On my second PC which doesn't have a proper BIOS update from manufacturer, I got an audit report that i need to "manually update BIOS" due to DO_NOT_TRUST issue.

However, upon checking event viewer and registry my keys were succesfully registered and the status is "Updated", Capable =2 and etc. Meaning my PC is performing proper secure boot. Yet the script tells me to update... Hm...

BIOS'es shipped with "DO NOT TRUST" Platform Keys work perfectly fine, in the sense that they accept all Secure Boot updates.

But the general community of Windows and BIOS security experts consider these PC's as highly susceptible to outside attack, because they all share the exact same PK instead of having the OEM create their own unique PK. When an OEM licenses a BIOS from a provider (AMI, Insyde, etc.), they're provided with a reference build for training purposes.

Thus the example code says "DO NOT TRUST". It's only intended for internal testing, and never for production code. But guess what? OEM's are idiots and people shipped the same PK in their released firmware. So if you figure out how to break the PK, or suspect one of the many OEM had an internal hack where the private signing key was leaked, then attackers can defeat the "DO NOT TRUST" PK.

What's the simple solution? For someone to actually follow "how to make your own PK" procedure and use that instead of just copying the reference example everyone else received. That's the whole basis of Secure Boot security, every vendor has an unique PK. And within some vendors, like Dell, HP or Lenovo, they may have several generations of PK's that are not the same across their different PC product lines.

---

TLDR: "DO NOT TRUST" works fine in a CA 2023 environment. But nobody in the security world trusts it can't be hacked. So if you care about those things, then you replace the "DO NOT TRUST". Some vendors like Dell went back, and re-released BIOS with a different PK. Others never bothered.

To replace this default PK, you can temporarily disable Secure Boot and delete all keys. Run the update script, and it will replace all of your keys with a MS reference example. [But wait, aren't they all the same keys from one source? Yes, but nobody thinks the Windows OEM PK has been hacked].

It's optional. But my script checks for "DO NOT TRUST" as a public service warning.

Great! Thanks for explanation. I will keep it in mind.

garlin said:

This is an ongoing issue that a lot of users are reporting, which will probably require a BIOS or Windows fix.

Click to expand...

Not the BIOS, I would have to flash 4 of them and there all up to date, it's def. Microsoft borked up last month

@garlin I guess I need more education " I suspect you're also getting the Event 87 SCEP errors which started after last month's update. This is an ongoing issue that a lot of users are reporting, which will probably require a BIOS or Windows fix"

Where in the Event Viewer are you all seeing this Event "87" I don't see it in System or "application" in Windows logs section

Windows Key + R, type compmgmt.msc (press Ctrl + Shift + Enter to run with full admin rights)

Look under you Event Viewer / Custom Views / Administrative Events for Event 87

There's a few threads on ElevenForum where users are complaining about it. Other forums are reporting it too.
SCEP Errors Too Many Requests Code 87

In the TPM, there's a set of HW security keys. Windows will sometimes try to connect to an outside Certificate Authority to confirm a key's validity (whether it should be revoked). After July, many users see Event ID 87 errors, reporting their PC is unable to get a working response from MS.

To date, I haven't heard a solid technical explanation for what's happening. There's only a handful of industry experts or security researchers that know how the TPM internals really work. And they're not sharing any clues on what's going on.

Klaver7 said:

Windows Key + R, type compmgmt.msc (press Ctrl + Shift + Enter to run with full admin rights)

Look under you Event Viewer / Custom Views / Administrative Events for Event 87

Click to expand...

Thanks, that is where I was looking but guess I'm lucky I'm not seeing '87' , strange thing is being able to 'filter custom view / task' is grayed out.

@TheVisitor Could you post a screen shot of that, not sure what you are seeing