On Manually updating UEFI CA2023 security keys

jumanji · Monday at 3:25 AM

Thanks @DarkShadowMD for your inputs.
1.The last Bios update for my Dell Inspiron 3280 AIO was 0.1.17.5 dated 03 Jul 2023. That I had updated then and there.
2. Dell has categorically stated they will not be issusing any new BIOS update for mitigating the CA2023 update
3. I had already run garlin's Check-SecureBootCerts.ps1. Will post the screenshot in my next post specifically addressed to garlin.
4. I am not in a hurry to do anything on this until I am sure that I will be doing the right thing.

The whole topic is so confusing for a novice like me

- you know I didn't know how to run the *.ps powershell script. Shame on me I had to educate myself and finally succeeded in running it

suatcini54 · Monday at 4:33 AM

XxXxX said:
3 chuwa laptops my grandchildren use wouldn't update secure boot.
it was only after i added the certs to the data base did the TPM/BIOS secure boot update
i have no explanation why or why not but that was the only way they would update.

the 2 HP all in ones in use updated their secure boot certs without the need to update the data base
again i can give no explanation why or why not, that was just the way it happened.

needless to say this whole affair to update systems has been time consuming.
best of luck Steve ..

Hi.

I will try to explain why placing Windows UEFI CA 2023 certificate in Windows certificate store is useless.

Security measure of Secure Boot is an intermediary process that takes place in UEFI firmware between "the time after BIOS nears completion of post" and "the time just after Windows starts loading" to counteract against bootkits, rootkits, whatnot.

The short name UEFI in "Windows UEFI CA 2023 certificate" implies that it should be an UEFI constituent and placed in UEFI firmware NVRAM. For this reason, there is no logic in my opinion to installing "Windows UEFI CA 2023 certificate" in Windows certificate store.

"Windows UEFI CA 2023 certificate" in Windows certificate store may become active, if it ever does, after Windows completes loading and does no good for boot-time protection. Windows Security, a.k.a. Windows Defender, or other 3rd-party security software, if installed, takes control when Windows is loaded.

You have PCA 2011 certificate in UEFI firmware and it is still active and in effect. The new certificates will be in effect sometime in June 2026 and PCA 2011 will be void in October 2026. Therefore, I think this is the reason why you see a green checkmark in Device Security of Windows Security if secure boot is on.

jumanji · Monday at 9:37 AM

Hi @garlin

1. The screenshot below shows the results of "Check-SecureBootCerts.ps1"

2. And here is what ChatGPT says

"Booting with the 2023 trust chain"'- What does it mean?

3. "Confirm--SecureBootUEFI" cmdlet shows the following screen

4.."Get-SecureBootUEFI" shows the following screen

Your expert opinion is solicited. Thanks.

garlin · Monday at 9:55 AM

jumanji said:
Hi @garlin

1. The screenshot below shows the results of "Check-SecureBootCerts.ps1"

This isn't my script, please download it from here:
garlin's PowerShell scripts for updating Secure Boot CA 2023

You will find the real script is more informative, please run it with the -Verbose option:

Code:

Check_UEFI-CA2023.ps1 -Verbose

suatcini54 said:
Therefore, I think this is the reason why you see a green checkmark in Device Security of Windows Security if secure boot is on.

Correct. Security Center gives you a green checkmark for simply having Secure Boot enabled. But the detailed message will be different, depending on whether you have the CA 2023 certs fully installed.

jumanji · Monday at 12:19 PM

garlin said:
This isn't my script, please download it from here:
garlin's PowerShell scripts for updating Secure Boot CA 2023

You will find the real script is more informative, please run it with the -Verbose option:

Code:

Check_UEFI-CA2023.ps1 -Verbose

That was your script only but in non-verbose mode. Sorry for that. The verbose mode screenshots below -split into two since it was too
long
.

You may read it alongwith the other screenshots in my previous post and give your opinion.

garlin · Monday at 12:37 PM

The problem is your BIOS has all of the other CA 2023 certs installed, except for the most important: KEK CA 2023. Without the KEK, the newer CA 2023 certs aren't validated in the UEFI security model.

Dell models don't really handle manual key enrollment, because they decided to only support a different encoded file format. You will have to delete the existing cert keys, and replace them. This is a non-destructive action, since the original CA 2011 certs are always in the factory defaults and you can reset back to factory mode.

1. BitLocker is disabled, which is good. Disable Windows Hello PIN if you're using it. When UEFI detects changes like certain cert updates, it invalidates BitLocker and Hello PIN codes stored in the TPM (as a security measure) and asks you to provide other means like a recovery key.

Therefore, we always ask users to check if they're using BitLocker or Hello PIN's.

2. Shutdown Windows. Enter the BIOS menus. Look for the Secure Boot settings. What you will see will depend on the exact model (because Dell uses at least 5 generations of BIOS code over the years).

3. If there is an option to switch from Standard Mode to Custom Mode, enable it.

4. Look for the option to Delete All Keys or Enter Setup Mode. Setup Mode wipes the current keys, and allows a new set of certs to be installed. Confirm Secure Boot mode is disabled.

5. Restart Windows. Run the check script again. It should recognize you're in Setup Mode (no certs present).

6. Run the update script, it should recognize you're in Setup Mode and download a new set of certs from MS's GitHub repo. It will install the Windows OEM Devices PK to replace the current Pegatron PK, and all of the CA 2011 + CA 2023 certs. If the script was successful (no errors), then shutdown Windows.

Code:

Update-UEFI.bat

7. Enable Secure Boot mode. Restart Windows and run the check script again. You should have a KEK CA 2023 and the 5 DB certs from before. At this point, CA 2011 revocation has not happened. You can wait for Windows to perform this later (this summer?).

One possible reason for delaying revocation is you would need to rebuild any bootable Windows ISO or Macrium-type recovery drives to use the newer CA 2023 boot manager file. There is no announced timeline when Windows will force a mandatory CA 2011 revocation, so we're in no hurry.

NormanF · Tuesday at 4:17 PM

garlin said:
This isn't my script, please download it from here:
garlin's PowerShell scripts for updating Secure Boot CA 2023

You will find the real script is more informative, please run it with the -Verbose option:

Code:

Check_UEFI-CA2023.ps1 -Verbose

Correct. Security Center gives you a green checkmark for simply having Secure Boot enabled. But the detailed message will be different, depending on whether you have the CA 2023 certs fully installed.

There is a GUI to check if the 2023 secure boot certificates are present and installed. Launch the O&O Shutup 10 Free portable application. Click on the secure boot tab. It will display the status and whether its ready to boot in the future.

KevTech · Tuesday at 4:42 PM

NormanF said:
There is a GUI to check if the 2023 secure boot certificates are present and installed. Launch the O&O Shutup 10 Free portable application. Click on the secure boot tab. It will display the status and whether its ready to boot in the future.

Now in security center of Windows.

NormanF · Tuesday at 4:46 PM

Not displayed in my main workstation security centre. The O&O shutup 10 Free secure boot tab reports its installed and present.

Borg 386 · 2026-06-03T08:31:30-0400

I don't know if this will help or not, but I had the same issue with the "more data needed." as well as the cert not being recognized,

I used the garlin script to d/l the new cert and even though it was installed & I rebooted several times I kept getting the same message that it needed updating.

I used one of the scripts to revoke the permissions of the old file manually & once I did that & rebooted, all was fine.

garlin's PowerShell scripts for updating Secure Boot CA 2023

1. Bucket Confidence Data is for IT admins, who manage large pools of PC's. It's not intended to be read by home users because it's a telemetry report. This event indicates you have installed all CA 2023 certs. 2. I don't support this script, it's not mine. I know why the other script is...

www.elevenforum.com

jumanji · 2026-06-03T10:52:17-0400

garlin said:
The problem is your BIOS has all of the other CA 2023 certs installed, except for the most important: KEK CA 2023. Without the KEK, the newer CA 2023 certs aren't validated in the UEFI security model...........

Dell models don't really handle manual key enrollment, because they decided to only support a different encoded file format. You will have to delete the existing cert keys, and replace them. This is a non-destructive action, since the original CA 2011 certs are always in the factory defaults and you can reset back to factory mode.

1. BitLocker is disabled, which is good. Disable Windows Hello PIN if you're using it. When UEFI detects changes like certain cert updates, it invalidates BitLocker and Hello PIN codes stored in the TPM (as a security measure) and asks you to provide other means like a recovery key.

Therefore, we always ask users to check if they're using BitLocker or Hello PIN's.

2. Shutdown Windows. Enter the BIOS menus. Look for the Secure Boot settings. What you will see will depend on the exact model (because Dell uses at least 5 generations of BIOS code over the years).

3. If there is an option to switch from Standard Mode to Custom Mode, enable it.

4. Look for the option to Delete All Keys or Enter Setup Mode. Setup Mode wipes the current keys, and allows a new set of certs to be installed. Confirm Secure Boot mode is disabled.

5. Restart Windows. Run the check script again. It should recognize you're in Setup Mode (no certs present).

6. Run the update script, it should recognize you're in Setup Mode and download a new set of certs from MS's GitHub repo. It will install the Windows OEM Devices PK to replace the current Pegatron PK, and all of the CA 2011 + CA 2023 certs. If the script was successful (no errors), then shutdown Windows.

Code:

Update-UEFI.bat

7. Enable Secure Boot mode. Restart Windows and run the check script again. You should have a KEK CA 2023 and the 5 DB certs from before. At this point, CA 2011 revocation has not happened. You can wait for Windows to perform this later (this summer?).

One possible reason for delaying revocation is you would need to rebuild any bootable Windows ISO or Macrium-type recovery drives to use the newer CA 2023 boot manager file. There is no announced timeline when Windows will force a mandatory CA 2011 revocation, so we're in no hurry.

Thanks for your detailed write- up and your untiring effort in helping forum members.
Since I have so many other things to do, I am going slow on this. In the meanwhile I need a few clarifications.

"3. If there is an option to switch from Standard Mode to Custom Mode, enable it." The Dell BIOS is already in Custom Mode. So I believe I am good to go further.

"4. Look for the option to Delete All Keys or Enter Setup Mode. Setup Mode wipes the current keys, and allows a new set of certs to be installed. Confirm Secure Boot mode is disabled."
Do you mean Confirm Secure Boot is Off/disabled ?

garlin · 2026-06-03T10:54:41-0400

jumanji said:
"4. Look for the option to Delete All Keys or Enter Setup Mode. Setup Mode wipes the current keys, and allows a new set of certs to be installed. Confirm Secure Boot mode is disabled."
Do you mean Confirm Secure Boot is Off ?

Yes. In case you boot, and have a Windows boot manager which doesn't match the current key configs. By turning off Secure Boot, you're allowed to boot anything. Afterwards, the script can update the boot file as needed.

On Manually updating UEFI CA2023 security keys

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Similar threads