How to check if your Secure Boot certs are updated. (three methods)

neldog · Dec 15, 2025

hader said:
Yes! Everything looks fine. All current values do have Green checkmarks. UEFI PK, KEK, DB and DBX. You're done. Congratulations.

(Script writer forgot to issue a new-line statement in the Current UEFI KEK section. If you make the CMD-box bigger than the spacing is not correct. (Less readable) Will tell him that.)

Hader, a big thank you for all your help to everyone on this! You have been very helpful with the support you have been giving.

hader · Dec 15, 2025

neldog said:
Hader, a big thank you for all your help to everyone on this! You have been very helpful with the support you have been giving.

That's nice to hear from you. My main reason for being on this forum is to help people. I have to take in consideration whom I am helping. Their backgrounds can differ from noobs to nerds. I can't see in advance whom I am helping. So I try to explain and solve things in a normal fashion.
Can be short and brief. Nobody has the same knowledge as I do. (Nerd-alert) I consider myself more as an investigator. Always want to find out why and try this to explain to other people in such a way they understand. Have some difficulties sometimes. Once posted I can not changed if other info pops up. (everything is changing all the time. Scripter cjee21 on github has changed his script already 3 time. Each time a bit better.... Kudos for him to solve this issue.) I think I will make a page somewhere where I can revise things if things changes. (I always write stuff down. Can be handy sometimes. Maybe I will look at it for some reason because of other things. "How did I solve this similar issue the last time?" Alter a script and I will have an other solution for things) I can always publish a page and point to that page in order to not repeating myself in different threads. I know a lot about the deeper things inside Windows. Only have to explain the basics. No need how things actually are working. (nice to know but not relevant to solve problems) Always; check this first and if that is this result then do this or else.. Just like scripting. :thumbsup:

(what I also love to do.....)
Take care. :wink:

HeavyHemi · Dec 15, 2025

I have no change when running the suggested files.

I'm still in this state:

It appears it is not letting me update the Microsoft UEFI CA 2023 cert.

Dirtyflash · Dec 15, 2025

HeavyHemi said:
I have no change when running the suggested files. View attachment 157061

I'm still in this state:
View attachment 157063

It appears it is not letting me update the Microsoft UEFI CA 2023 cert.

Have a peak at this short thread, there might be a helpful clue.

Consistent TPM-WMI 1795 error events

Hi, as the title says I'm getting consistent 1795 TPM WMI errors in event viewer which are accompanied by system hitches that last from 1-5 seconds after about 5-7 minutes of uptime(Repeats every 12 hours). I imagine it's attempting to update secure boot or the keys or the firmware itself, but I...

www.elevenforum.com

XxXxX · Dec 15, 2025

HeavyHemi said:
I have no change when running the suggested files. View attachment 157061

I'm still in this state:
View attachment 157063

It appears it is not letting me update the Microsoft UEFI CA 2023 cert.

sometimes the update can take several days and several restarts while the 'InProgress' settings is active.
i can give no reason why. on a oldish Asus 22" all in one it took 3 days and several restarts for the registry to display 'Updated'

best of luck Steve ..

fg2001gf11F · Dec 15, 2025

XxXxX said:
sometimes the update can take several days and several restarts while the 'InProgress' settings is active.
i can give no reason why. on a oldish Asus 22" all in one it took 3 days and several restarts for the registry to display 'Updated'

best of luck Steve ..

This is what I get on a Dell XPS 8940, it shows Updated in the registry.
But I don't know how to interpret these red X messages and the "SVN : None" at the bottom.

XxXxX · Dec 15, 2025

all i can tell you is that the system is booting using the secure boot 2023 cert
and that was what i was after, the rest of it like KEK i will leave to Microsoft to sort out.

the main thing is my systems are booting from and with the updated 2023 cert in place.
best of luck Steve ..

HeavyHemi · Dec 16, 2025

Dirtyflash said:
Have a peak at this short thread, there might be a helpful clue.

Consistent TPM-WMI 1795 error events

Hi, as the title says I'm getting consistent 1795 TPM WMI errors in event viewer which are accompanied by system hitches that last from 1-5 seconds after about 5-7 minutes of uptime(Repeats every 12 hours). I imagine it's attempting to update secure boot or the keys or the firmware itself, but I...

www.elevenforum.com

I do not have any form of TPM at all. That might be a reason to show a write permissions error if there is no device, TPM, to write to. If I run using the '040' reg key, I do not show any errors in the registry but I will still eventually get the 1801 error in event viewer after the task runs. Right now the only cert I cannot get to update is the Microsoft UEFI CA 2023.

garlin · Dec 16, 2025

EVGA X99 FTW K's last BIOS update was in 2016. You're better off running Mosby to finish the process since no vendor-provided KEK CA 2023 will be made available from the vendor or MS.

HeavyHemi · Dec 16, 2025

garlin said:
EVGA X99 FTW K's last BIOS update was in 2016. You're better off running Mosby to finish the process since no vendor-provided KEK CA 2023 will be made available from the vendor or MS.

Actually 2019.

Version 2.08. I worked with EVGA to get this BIOS released to update the microcode that prevented overclocking the CPU.
I thought about reaching out to EVGA, but the company is now a shell of its former self and I don't think there is still anyone around that would even bother to look at it. Frankly I don't believe I'm going to mess with this any more. As I posted earlier, with absolutely no form of TPM or any way to add it, this motherboard is ending its useful life. Too bad because it is perfectly adequate.

garlin · Dec 16, 2025

If the BIOS menu has a way to manage certs manually, you could copy the KEK CA 2023 .der file to an USB drive, and enroll it to the KEK variable.

Dirtyflash · Dec 16, 2025

garlin said:
If the BIOS menu has a way to manage certs manually, you could copy the KEK CA 2023 .der file to an USB drive, and enroll it to the KEK variable.

Curious what brands tend to have more options to manage the certificates in the BIOS. The Lenovo Thinkpad is definitely not.

garlin · Dec 16, 2025

Some of them do, I was researching different vendor's BIOS setup menus. And at least one Lenovo doc showed those options, but it didn't referenced which models supported that BIOS version.

HeavyHemi · Dec 16, 2025

garlin said:
If the BIOS menu has a way to manage certs manually, you could copy the KEK CA 2023 .der file to an USB drive, and enroll it to the KEK variable.

There is, that's how I manually updated the KEK with the Microsoft Corporation KEK 2K CA 2023 using the secure boot options in the BIOS. What I don't have is Microsoft UEFI CA 2023 which is stored in DB according to Windows Secure Boot certificate expiration and CA updates - Microsoft Support.

garlin · Dec 16, 2025

You can repeat the same process with this file:
https://raw.githubusercontent.com/m...ts/DB/Certificates/microsoft uefi ca 2023.der

MS UEFI CA 2023 is not used by Windows, it's intended for Linux distros. But it's understandable you want the complete set of updates.

HeavyHemi · Dec 16, 2025

garlin said:
You can repeat the same process with this file:
https://raw.githubusercontent.com/m...ts/DB/Certificates/microsoft uefi ca 2023.der

MS UEFI CA 2023 is not used by Windows, it's intended for Linux distros. But it's understandable you want the complete set of updates.

I was not aware that Windows does not need this. First time I've heard of that. If it isn't needed, I'm not going to worry about it. It is easy enough to silence the event viewer errors.

fg2001gf11F · Dec 18, 2025

garlin said:
You can repeat the same process with this file:
https://raw.githubusercontent.com/microsoft/secureboot_objects/refs/heads/main/PreSignedObjects/DB/Certificates/microsoft uefi ca 2023.der

MS UEFI CA 2023 is not used by Windows, it's intended for Linux distros. But it's understandable you want the complete set of updates.

@garlin,
I just updated manually the BIOS on this GMKtec M2 Mini PC, pointing the BIOS to add the 1st of the 2 files that I have on this FAT32 USB flash.

From what I can see here after rebooting 2 times, I think I should be now all set.
Anything else I should check or worry about?
Please let me know, thanks.

garlin · Dec 18, 2025

You're done. Except for the DBX revocation, which can wait until 2026.

fg2001gf11F · Dec 18, 2025

garlin said:
You're done. Except for the DBX revocation, which can wait until 2026.

Thanks,
Now I have to see if I can do the same on DELL XPS 8930.
Navigating the BIOS on that DELL XPS 8930 machine is pretty messy.

Edit:
I finally managed to do this update also on the DELL XPS 8930. I hope everything works out.

Microsoft Corporation KEK 2K CA 2023 added manually on Dell XPS 8930 BIOS 1.1.31 using the same USB flash drive I used on the GMKtec M2 yesterday.

hader · Dec 18, 2025

garlin said:
You can repeat the same process with this file:
https://raw.githubusercontent.com/microsoft/secureboot_objects/refs/heads/main/PreSignedObjects/DB/Certificates/microsoft uefi ca 2023.der

MS UEFI CA 2023 is not used by Windows, it's intended for Linux distros. But it's understandable you want the complete set of updates.

Just a word of advice; Do not install this certificate. It's not needed and besides that; it is invalid because the root certificate where this is based on does not exists. (Microsoft RSA Device Root CA 2021) Use certmgr.msc to see for yourself. certificates in general are based on an Intermediate certificate. This Intermediate certificate is then based on a Root certificate. This certificate is directly based on a Microsoft RSA Device Root CA 2023 certificate.

If you look at the trusted root certification authorities tree inside certmgr.msc you can see that this Root certificate "Microsoft RSA Device Root CA 2023" does not exist. I would not trust any certificate that does not have the proper Intermediate or Root certificate installed. If the Root certificate should be there; It must has to be distributed by Microsoft themself. It's their certificate. If they think it's needed they will update the Root certificate store. For now it's not.

I find the link a bit strange. raw.githubusercontent.com? The only site I trust is github.com. And I find it strange that if you go back in it's path all path's are invalid. It seems that only this link exists. There are no sites below it.

All everybody has to do is run "Check UEFI PK, KEK, DB and DBX.cmd" script as a part of GitHub - cjee21/Check-UEFISecureBootVariables: PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables as well as scripts for other Secure Boot related items.
If there are Green checkmarks inside the Current values of UEFI PK, KEK, DB and DBX you are ready when MS will replace all signed files based on the new CA2023 certificate. It's now stil based on soon to be expired (Oct 2026) CA2011 certificate.

P.S. And MS UEFI CA 2023 is used by Microsoft. See screendump.

CA2023 Solved Check PK,KEK,DB,DBX new#1.webp

How to check if your Secure Boot certs are updated. (three methods)

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Just a Computer User

My Computers

Well-known member

My Computer

Just a Computer User

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer