Secure Boot Certificate problems with GT1 Mega

I'm having trouble with Secure Boot on a Geekom GT1 Mega Intel version (Intel Core Ultra 9 185H). No matter what I do, I can't get it to install the latest certificates, and the most recent attempt left me unable to enable Secure Boot!

Is there any way to 'reset' the BIOS so that I can start again??

Hello @TomTiddler167 and welcome to ElevenForum.


Also, here's ten points for filling out your computer specs.





Here's some other things that you may find useful...

1. Have you installed the latest BIOS update?
GT1 Mega – Geekom

2. On the bottom of the support page, they have a Secure Boot CA 2023 update. Which is actually the KEK CA 2023 certificate file which you're supposed to copy to an USB drive, and manually import following the "Tutorial".
https://support.geekompc.com/upload.../Tutorial on Importing Certificate Images.png

To Garlin ...

1) Yes

2) I thought I did this, but that immediately preceeded the inability to enable Secure Boot, so I suspect I did something wrong

1. Leave Secure Boot disabled for now.

2. Download the ZIP from here, and run:

3. Post the script's results so we can see what your current settings.

Here's the output of Check_UEFI

------------------------
Secure Boot: OFF
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI PK Cert
------------
DO NOT TRUST - OEM Test Certificate
Platform Key is UNTRUSTED.

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011

UEFI DBX Certs
--------------
(NONE)

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: "WindowsUEFICA2023Capable" = 0
[Windows UEFI CA 2023] not in UEFI DB.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

REQUIRED ACTION
===============

MANUAL UPDATE of the BIOS is required.

Enter the BIOS menu, and search for User or Custom Mode option of updating the UEFI PK or KEK keys.
If your BIOS doesn't support this feature, select Setup Mode to clear all certs.

IMPORTANT: Disable Windows Hello PIN before clearing certs.

OPTION 1: To install [UEFI CA 2023] certs

Update_UEFI-CA2023.ps1


OPTION 2: To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert

Update_UEFI-CA2023.ps1 -Revoke

From your output, this BIOS should be ready to accept Secure Boot updates from Windows.

1. Geekom shouldn't be using the "DO NOT TRUST - OEM Test Certificate". It's a default copy of the BIOS they (or their Chinese OEM supplier) are licensing, and nobody changed the standard test example for the PK. While it works perfectly fine with "DO NOT TRUST", it's generally frowned upon for security reasons.

The script warns you about these types of "DO NOT TRUST" PK's as a public service.

2. You should be able to enable Secure Boot mode, and restart Windows. Is the problem that you can't enable Secure Boot mode? Is the BIOS setup for pure UEFI mode? (no CSM or UEFI + CSM mode)

Yes, when I enable Secure Boot in the BIOS I get a warning message. I can provide a photo of that screen if it helps.

That will probably help.

Never mind. You need to perform the cert updates since CA 2023 keys are missing (other than KEK CA 2023).

1. Leave Secure Boot disabled.

2. Run the update script.

3. Run the check script again

You should now see (5x) UEFI DB Certs listed. After that you should be able to turn on Secure Boot.

Thankyou, thankyou, thankyou!!!! Finally, I appear to have got it thanks to your help, SecureBoot enabled successfully and seems like all the certs are in place.