How to check if your Secure Boot certs are updated. (three methods)

gunrunnerjohn · Dec 20, 2025

I think I'd start over with the configuration.

NormanF · Dec 20, 2025

Let Windows manage secure boot certificates. If there's an update needed, Windows Update will download and install it.

Dirtyflash · Dec 20, 2025

HeavyHemi said:
I am not sure what happened here. I was in the BIOS and decided to save the secure boot keys. Exited out of the menu, rebooted and was greeted with this: View attachment 157522

So, I go back in to the BIOS and notice that the authorized signatures was set to default. I tried to restore this from the save I had just made but apparently that didn't work.
View attachment 157525

So I had to disable secure boot to get back to the desktop. My secure boot now seems all jacked up.

View attachment 157524

Just a guess, but I think your current image and BIOS have a Windows UEFI CA mismatch. BIOS has 2011 and current image is 2023. Maybe try installing the 2023 certificate to get them to match. This may not be of any help, but it will only take a minute or so of your time to try.

gunrunnerjohn · Dec 20, 2025

NormanF said:
Let Windows manage secure boot certificates. If there's an update needed, Windows Update will download and install it.

Actually, I don't believe this is universally true.

HeavyHemi · Dec 20, 2025

gunrunnerjohn said:
I think I'd start over with the configuration.

Ha... well that's the thing. I have no idea where to start. This OS was originally installed as Windows 10 in May of 2022. :scream:

I already tried a online repair install, which is the same as an in place upgrade install. No change. I don't actually need secure boot, I'm just OCD about things not working correctly. I'm going to be building a new system in another 6 months or so anyway. Doing a clean install, would take days to restore all the games I have even though they are on different drives. Revalidating by the various platforms takes forever. It is somewhat faster with SSDs than it was with HDDs.

starchase · Dec 20, 2025

@HeavyHemi Just a thought, you could, in your BIOS, restore the default Secure Boot settings ("Delete All Secure Boot Variables"} and then start the update process seen here to install the CS 2023 certs. I think that will get you all set up.

Buddywh · Dec 20, 2025

hader said:
I find the link a bit strange. raw.githubusercontent.com? The only site I trust is github.com. And I find it strange that if you go back in it's path all path's are invalid. It seems that only this link exists. There are no sites below it.

That site is a GitHub run domain they use to serve up "raw" files directly from GitHub servers without requiring a person to filter through a bunch of them and find what's needed. Developers use it, typically for scripts to fetch a file at run-time. It was quite likely cut/pasted directly from one since it's also very useful in a forum post to make sure someone gets the correct file.

I assume you don't mean to say it's harmful. For most of us it is optional (only one of my machines' BIOS updates even include it as a default 2023 key), but it is nice to have for completeness sake if nothing else.

hader · Dec 20, 2025

Thierry 83200 said:
Good evening, is this situation satisfactory or should I do something else? Thank you for your help.
Sincerely,

No. You're done.

Maybe run the following commands (Powershell as admin) and try to update your version of "Windows Bootmgr SVN" from 5.0 to 7.0.
It's possible this is caused by not being on the latest build version.
Can't hurt.
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

If it stays at 5.0 than your not at the latest build. If you will this version will be 7.0.

hader · Dec 20, 2025

starchase said:
@HeavyHemi Just a thought, you could, in your BIOS, restore the default Secure Boot settings ("Delete All Secure Boot Variables"} and then start the update process seen here to install the CS 2023 certs. I think that will get you all set up.

How is "delete all secure boot variables" a restore? Your wiping them clear. There must be an other option; "Install Default Secure Boot Keys" that will restore the values.

starchase · Dec 20, 2025

hader said:
How is "delete all secure boot variables" a restore? Your wiping them clear. There must be an other option; "Install Default Secure Boot Keys" that will restore the values.

The post read remove and then start again w/ Post # 1 as referenced, to bring the machine up to compliance.

HeavyHemi · Dec 20, 2025

hader said:
How is "delete all secure boot variables" a restore? Your wiping them clear. There must be an other option; "Install Default Secure Boot Keys" that will restore the values.

Believe it or not, deleting both the platform key and KEK, put the system in setup mode and allowed me to boot with secure boot enabled. Those two fields in the BIOS for secure boot the platform key and the KEK, have no key number and now just have an asterisk. Lets see now if it will update again.

garlin · Dec 20, 2025

By definition, Secure Boot is disabled without a valid Platform Key. The PK undersigns the KEK, which undersigns the DB's and DBX's.

You can either perform a factory reset, or apply the Windows OEM Devices PK in its place. Windows can update everything once you apply a PK which has a matching signed KEK CA 2023. If you vendor doesn't have one, the Windows OEM Devices PK is designed as the last-resort fallback option.

HeavyHemi · Dec 20, 2025

garlin said:
By definition, Secure Boot is disabled without a valid Platform Key. The PK undersigns the KEK, which undersigns the DB's and DBX's.

You can either perform a factory reset, or apply the Windows OEM Devices PK in its place. Windows can update everything once you apply a PK which has a matching signed KEK CA 2023. If you vendor doesn't have one, the Windows OEM Devices PK is designed as the last-resort fallback option.

That's what I am using. What apparently was affected was the 'Authorized Signatures'. The platform key and the KEK are the same as before. What isn't the same is, as I mentioned, the Authorized signatures. I'm just going to leave it alone. Unfortunately, as this system also has zero form of TPM, its lifespan as a gaming PC is growing short.

garlin · Dec 20, 2025

In your BIOS, Authorized Signatures = DB list and Forbidden Signatures = DBX list. Deleting all the variables should (in theory) zero out all the bytes.

When you go through the MS process, it should:
- repopulate DB
- repopulate DBX
- repopulate DBX with the list of banned EFI file hashes

If you're willing, I have a PS Script which might fix your system. It can detect an UEFI with a deleted PK, and "do the right thing". Let me know if you want to try it. It's worked in my VM testing, but I don't have an older PC to confirm

HeavyHemi · Dec 20, 2025

garlin said:
In your BIOS, Authorized Signatures = DB list and Forbidden Signatures = DBX list. Deleting all the variables should (in theory) zero out all the bytes.

When you go through the MS process, it should:
- repopulate DB
- repopulate DBX
- repopulate DBX with the list of banned EFI file hashes

If you're willing, I have a PS Script which might fix your system. It can detect an UEFI with a deleted PK, and "do the right thing". Let me know if you want to try it. It's worked in my VM testing, but I don't have an older PC to confirm

The issue I am having right now is no variant of managing the secure keys allows me to get past the invalid signature red error screen when secure boot is enabled. If I delete the DB keys, the system will not boot at all even with secure boot disabled. I have to do a CMOS reset, load up a saved BIOS profile... rinse and repeat at least three times. Unfortunately this BIOS doesn't save secure boot keys when you save a profile. That's a separate process. Though that might be a feature instead of a bug.

Dirtyflash · Dec 20, 2025

garlin said:
In your BIOS, Authorized Signatures = DB list and Forbidden Signatures = DBX list. Deleting all the variables should (in theory) zero out all the bytes.

When you go through the MS process, it should:
- repopulate DB
- repopulate DBX
- repopulate DBX with the list of banned EFI file hashes

If you're willing, I have a PS Script which might fix your system. It can detect an UEFI with a deleted PK, and "do the right thing". Let me know if you want to try it. It's worked in my VM testing, but I don't have an older PC to confirm

Does your BIOS have a reset option on the menu tab where you would normally select Save and Exit. Alternatively, can you downgrade the BIOS version to see if that helps? It really shouldn't be causing you so much trouble.

HeavyHemi · Dec 20, 2025

Dirtyflash said:
Does your BIOS have a reset option on the menu tab where you would normally select Save and Exit. Alternatively, can you downgrade the BIOS version to see if that helps? It really shouldn't be causing you so much trouble.

It wasn't causing me problems until somehow the DB got corrupted in the BIOS when trying to save the secure boot variables. Downgrading the BIOS wouldn't solve anything and would introduce a microcode issue that prevents overclocking. I can restore the default keys just fine. I can restore the PK and the KEK to what it was using when it was booting fine from the 2023 efi. So I believe my problem lies in a mismatch in the signatures between the secure boot DB in nvram and the EFI boot DB .

garlin · Dec 20, 2025

If I had to guess, at a minimum you need:
- A valid PK (Windows OEM Devices)
- A valid KEK (either CA 2011 or CA 2023 certificate loaded from USB drive)
- A valid DB (either Windows CA 2011 or Windows CA 2023 to match the KEK loaded from USB drive)

That's the least number of certs to get booted.

HeavyHemi · Dec 20, 2025

Okay, success! I cleared the authorized keys, then added just the windows uefi ca 2023.der from ms github to the DB. I can now boot with secure boot enabled. Now I just have to do the rest over again. Once it has updated to where it was before, I'm leaving the secure boot in the BIOS alone.
Wellllll.... One weirdness I discovered is if you delete the default DB in the BIOS then add just the Windows 2023 der, the system will boot into Windows. However, it will NOT let you back into the BIOS. Hitting the delete key gets you nothing but a black screen. So to resolve this, reset CMOS, set a new key in the DB which gives you a choice of setting the default or a new one. This time I selected default. I then appended both the MS and Windows 2023 DB der.
I'm back to this state:

Thierry 83200 · Dec 21, 2025

Hello Hader,
how do I update the "Windows Bootmgr SVN" version from 5.0 to 7.0? Thank you.

How to check if your Secure Boot certs are updated. (three methods)

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

@HeavyHemi Just a thought, you could, in your BIOS, restore the default Secure Boot settings ("Delete All Secure Boot Variables"} and then start the update process seen here to install the CS 2023 certs. I think that will get you all set up.​

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

@HeavyHemi Just a thought, you could, in your BIOS, restore the default Secure Boot settings ("Delete All Secure Boot Variables"} and then start the update process seen here to install the CS 2023 certs. I think that will get you all set up.​

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

My Computers

My Computers

My Computer

My Computers

My Computer

@HeavyHemi Just a thought, you could, in your BIOS, restore the default Secure Boot settings ("Delete All Secure Boot Variables"} and then start the update process seen here to install the CS 2023 certs. I think that will get you all set up.

My Computers

My Computers

My Computers

@HeavyHemi Just a thought, you could, in your BIOS, restore the default Secure Boot settings ("Delete All Secure Boot Variables"} and then start the update process seen here to install the CS 2023 certs. I think that will get you all set up.

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer