How to check if your Secure Boot certs are updated. (three methods)

*edit* ah, i misread something.

If there would be an update for the Surface - wouldn't i get it via Windows Update as always?

Is it recommended to do the update manually? Never did this for a Surface device.

Normally, MS would push Surface firmware updates thru the Surface app, or by using WU.

Support ended on Oct 2025, so SurfacePro7_Win11_22621_25.090.3489.0.msi is your last update.
Surface devices driver and firmware lifecycle for Windows-based devices - Surface

Surface device	Release date	End-of-servicing date for firmware & drivers
Surface Pro 7	October 22, 2019	October 30, 2025

Click to expand...

Download Surface Pro 7 Drivers and Firmware from Official Microsoft Download Center

1. Download from here:
https://download.microsoft.com/down...bf4/SurfacePro7_Win11_22621_25.090.3489.0.msi

2. Run the MSI. Considering it's from Sep 2025, it should have CA 2023 certs baked in.

Hey garlin,

before i try this - wouldn't this be too optimistic?
Microsoft states, that 17.200.140.0 is the minimum version for the new secure boot certificates.
The 17.200.140.0 is from december 2023.
Or am i getting this wrong?

EDIT: Softpedia gives further information about the official package, listing no change in the UEFI, keeping the 24.109.140 in the SurfacePro7_Win11_22621_25.090.3489.0.msi-Package.
---> Further Information on Softpedia
I of course don't know, if the info there is trustworthy.

I would assume they added CA 2023 in an earlier firmware, but if you're getting weird results from reading the UEFI variables then it could be a firmware bug. So applying the last firmware would presumably resolve any problems.

The machine is end of life, so this is it in terms of final updates. My script works with a range of different PC's, any returned "Unexpected errors" are caused by BIOS issues that vary from the spec.

I just did the update, which was kinda weird. It successfully finished and asked me to reboot, which i did. There were no progress bars as usual midboot (there is a special screen for surface devices with a progress bar).

Took like 10 seconds and it feels like it did nothing at all.

Your script:
Same result again unfortunately

cjee:
The result for the Default DB is the same
The result for the DBX gives me errors now in v1.5.1 and v1.6.0

I'll have to find a debug version of my script for you.

Run this script and see if you still get an error message.

Hi, here comes the output :) :

---

Die Variable ist zurzeit nicht definiert: 0xC0000100
PKdefault Count: 0

PK Count: 1

Subject
-------
CN=Windows OEM Devices PK, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Die Variable ist zurzeit nicht definiert: 0xC0000100
KEKdefault Count: 1
CN=Windows OEM Devices PK, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

KEK Count: 2
CN=Microsoft Corporation KEK CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US

Die Variable ist zurzeit nicht definiert: 0xC0000100
DBdefault Count: 2
CN=Microsoft Corporation KEK CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US

DB Count: 5
CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft Corporation UEFI CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US

Die Variable ist zurzeit nicht definiert: 0xC0000100
DBXdefault Count: 5
CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft Corporation UEFI CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US

DBX Count: 0

Natürlich sind die Wörter auf Deutsch anders.
"Variable is currently undefined" wird nach als "Die Variable ist zurzeit nicht definiert" geschreibt.

Try this version.

okay, i'm late to the party, i'll go back and read some previous posts, but if anyone has a "ohhh, you need THIS, here" type of thing, i would appreciate it.

Valis said:

okay, i'm late to the party, i'll go back and read some previous posts, but if anyone has a "ohhh, you need THIS, here" type of thing, i would appreciate it.

Click to expand...

@garlin

Valis said:

ohhh, you need THIS

Click to expand...

Secure boot is disabled.

@Valis
Welcome to ElevenForum.
While waiting for garlin, you should fill in your computer specs.
We especially need the CPU and the motherboard model number.







Here's some other things that you may find useful...

Valis said:

okay, i'm late to the party, i'll go back and read some previous posts, but if anyone has a "ohhh, you need THIS, here" type of thing, i would appreciate it.

Click to expand...

Wow. Something really corrupted your certs. Did you recently update the firmware?

Try "Reset to factory defaults", and re-run the script.

garlin said:

Natürlich sind die Wörter auf Deutsch anders.
"Variable is currently undefined" wird nach als "Die Variable ist zurzeit nicht definiert" geschreibt.

Try this version.

Click to expand...

Hi Garlin,

this is the newest script:

---

SetupMode = 0

PKdefault Count: 0

PK Count: 1

Subject
-------
CN=Windows OEM Devices PK, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

KEKdefault Count: 0

KEK Count: 2
CN=Microsoft Corporation KEK CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US

DBdefault Count: 0

DB Count: 5
CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft Corporation UEFI CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US

DBXdefault Count: 0

DBX Count: 0

This should fix the problems where your Windows locale isn't English.

Hi, I ran the script, and applied the updates using the method OP linked on his original post, however only my SVN results changed after doing all that.
And while I had success using these scripts: garlin's PowerShell scripts for updating Secure Boot CA 2023
My results still shows two "X"s, and I was wondering if that's normal.

Thanks in advance.

Bonzo said:

Hi, I ran the script, and applied the updates using the method OP linked on his original post, however only my SVN results changed after doing all that.
And while I had success using these scripts: garlin's PowerShell scripts for updating Secure Boot CA 2023
My results still shows two "X"s, and I was wondering if that's normal.

Click to expand...

The key difference between cjee21's script and my own, is I don't inaccurately report some conditions as errors.

Factory keys hold whatever default certs the OEM has decided to include in the firmware. MS has informed OEM's that MS UEFI CA 2023 (primarily used by Linux) and Option ROM can be optional. But those two certs can always be applied to the UEFI, at any time.

Their absence in the defaults isn't something you can change (it's part of the firmware), and it's not really a problem.

And strangely cjee21's script doesn't explicitly inform you that PCA 2011 is on the DBX...

garlin said:

The key difference between cjee21's script and my own, is I don't inaccurately report some conditions as errors.

Factory keys hold whatever default certs the OEM has decided to include in the firmware. MS has informed OEM's that MS UEFI CA 2023 (primarily used by Linux) and Option ROM can be optional. But those two certs can always be applied to the UEFI, at any time.

Their absence in the defaults isn't something you can change (it's part of the firmware), and it's not really a problem.

And strangely cjee21's script doesn't explicitly inform you that PCA 2011 is on the DBX...

Click to expand...

Oh, got it, thank you. I don't quite understand the part about the PCA 2011, but I'm assuming it isn't an issue?

The other script reports that "PCA 2011 (revoked: True)" in the DB category, which implies PCA 2011 was added to the DBX list.

But if you're not familiar with how Secure Boot variables work, you would feel more comfortable seeing an explicit list of DBX certs. That explanation is easier for most people to follow, and doesn't lead to more follow up questions.