Solved Secure boot update HowTo

RJARRRPCGP said:

I wondered if missing the "Microsoft UEFI CA 2023" would cause video drivers to not work anymore in 2026.

Click to expand...

As I understand it, the only way it should be able to cause problems is if the video drivers were signed by the Microsoft UEFI CA 2023 certificate, but that's not what this cert is used for. This certificate is used to validate code before it opens the System partition (decrypting it if it's Bitlockered) to initiate boot-up which is a point where the UEFI BIOS can't even "see" the drivers to validate them.

It might be used to validate OptionROM code in your video card, which has to execute before start-up (to get a display for running BIOS screens) I suppose, but that's speculation. There is concern with some Nvidia GPU's cards, but that's because they used the Windows CA to validate their code. If you've revoked trust in windows CA 2011 and haven't had a problem I'd suspect that's a problem you don't have anywy.

Buddywh said:

As I understand it, the only way it should be able to cause problems is if the video drivers were signed by the Microsoft UEFI CA 2023 certificate, but that's not what this cert is used for. This certificate is used to validate code before it opens the System partition (decrypting it if it's Bitlockered) to initiate boot-up which is a point where the UEFI BIOS can't even "see" the drivers to validate them.

It might be used to validate OptionROM code in your video card, which has to execute before start-up (to get a display for running BIOS screens) I suppose, but that's speculation. There is concern with some Nvidia GPU's cards, but that's because they used the Windows CA to validate their code. If you've revoked trust in windows CA 2011 and haven't had a problem I'd suspect that's a problem you don't have anywy.

Click to expand...

Only the "PCA" certificate is in the DBX.

RJARRRPCGP said:

Only the "PCA" certificate is in the DBX.

Click to expand...

And that's all that needs to be because it is the only one used to validate Windows's Boot Manager. That's the way I'm understanding it at least.

The revocations are being done largely to mitigate risks from Black Lotus and other Secure Boot exploits targeting Windows. There may be other exploits but they'd not be targeting Windows if Windows doesn't need the Microsoft key for boot-time validations. At least, that's how I see it from what I've been able to read.

Buddywh said:

And that's all that needs to be because it is the only one used to validate Windows's Boot Manager. That's the way I'm understanding it at least.

Click to expand...

I keep wondering if it's the "Microsoft Corporation" one.

fg2001gf11F said:

I think the block is in the Dell BIOS of the XPS 8930.

Click to expand...

fg2001gf11F said:

My BIOS is Version 1.1.31, Dated 2923-11-21. Dell is saying that it is the latest for my XPS 8930.
So much for supporting their machines.

Click to expand...

Just FYI, there won't be a firmware update with the new certs for the 8930.

ASUS too , latest update ; Z97-K-ASUS-2902 from 5-2-20.............
Im on legacy , no EUFI .

pseymour said:

Just FYI, there won't be a firmware update with the new certs for the 8930.

Microsoft 2011 Secure Boot Certificates Expiration for Out of Scope Platforms for BIOS Updates | Dell US

Click to expand...

My System Two falls into this category. But according to that Dell URL... I should be okay. This below if from the Dell URL you posted. Thanks for that link, I am feeling a little better about this now.

neldog said:

My System Two falls into this category. But according to that Dell URL... I should be okay. This below if from the Dell URL you posted. Thanks for that link, I am feeling a little better about this now.


View attachment 154514

Click to expand...

Are they suggesting, if you can get all of the certificates now through Windows Update, other than the 2023 KEK certificate, don't be concerned? Is Dell going to provide MS with a new KEK certificate for systems shipped prior to 2020, which can then in future be pushed through with Windows Update?

Dirtyflash said:

Are they suggesting, if you can get all of the certificates now through Windows Update, other than the 2023 KEK certificate, don't be concerned? Is Dell going to provide MS with a new KEK certificate for systems shipped prior to 2020, which can then in future be pushed through with Windows Update?

Click to expand...

All I know is what I displayed in my post - I have never communicated with Dell about this.

Here is how that, (my System Two) looks today.

neldog said:

All I know is what I displayed in my post - I have never communicated with Dell about this.

Here is how that, (my System Two) looks today.


View attachment 154522

Click to expand...

So you're getting a KEK CA 2023, which means Dell must have furnished one back if Microsoft pushed them into your firmware through Update.

What's interesting is there's a PCA 2010 in DBX yet you have (still) a PCA 2011 in DB with no PCA 2010. How does that happen?

Buddywh said:

So you're getting a KEK CA 2023, which means Dell must have furnished one back if Microsoft pushed them into your firmware through Update.

Click to expand...

If that's the case, it's interesting in that they've provided a updated KEK CA 2023 certificate via Windows Update to a unsupported device.

Dirtyflash said:

If that's the case, it's interesting in that they've provided a updated KEK CA 2023 certificate via Windows Update to a unsupported device.

Click to expand...

I assume it's got to be cheaper than taking a BIOS revision through review and testing so why not.

Buddywh said:

I assume it's got to be cheaper than taking a BIOS revision through review and testing so why not.

Click to expand...

Yeah, that does make sense and it's still a good thing. Questions is, will the other OEM's do the same?

Dirtyflash said:

will the other OEM's do the same?

Click to expand...

I wasn't gonna wait to find out. I just MOSBY'd my circa 2014 unsupported systems and called it a day (or maybe decade and a half, considering the 15 year life of these certificates).

But the MOSBY went so well I even did it to my systems with modern motherboards and BIOS updates.

Buddywh said:

I wasn't gonna wait to find out. I just MOSBY'd my circa 2014 unsupported systems and called it a day (or maybe decade and a half, considering the 15 year life of these certificates).

But the MOSBY went so well I even did it to my systems with modern motherboards and BIOS updates.

Click to expand...

Hmm, is there an actual step-by-step DIY guide to applying the MOSBY fix? I've tried to research it, without ever gaining a clear understanding of how it's supposed to be used by an average person.

Dirtyflash said:

Hmm, is there an actual step-by-step DIY guide to applying the MOSBY fix? I've tried to research it, without ever gaining a clear understanding of how it's supposed to be used by an average person.

Click to expand...

See

Dirtyflash said:

Hmm, is there an actual step-by-step DIY guide to applying the MOSBY fix? I've tried to research it, without ever gaining a clear understanding of how it's supposed to be used by an average person.

Click to expand...

It's really quite easy:

First thing to do is prepare an EFI bootable USB drive with the Mosby files on it. Go get RUFUS, the latest version, to create it. Use the Bootable UEFI V2.2 option and it will both create the EFI bootable USB drive and copy in the MOSBY files you'll need. Once you have a bootable USB drive with the MOSBY files go to the next part.

There are how-to's all over Eleven Forums on using RUFUS to create EFI bootable drives, and even a few youtube vid's.

In BIOS settings disable Secure Boot and put it in what's called SETUP mode. It depends on how your BIOS is set up, with some you just delete all the keys (not reset, completely delete). If you can't find this then MOSBY won't work; UEFI Secure Boot MUST be in SETUP mode (all the key variables emptied) to have keys installed like this.

Read the MOSBY README's that are on the USB drive.

Then restart the system and boot into the EFI bootable USB drive you created.

Run MOSBY from the EFI command line. It does the rest. There are command line options (covered in the readme) for doing custom things (like including your own key you might want in DB as for booting to another OS like Linux), you don't really need to worry those just run MOSBY and it does what's needed for Windows to boot.

Once it's finished, reboot into BIOS settings, enable Secure Boot, boot into the system.

If you see there's a STANDARD mode and CUSTOM mode, leave it in CUSTOM mode or it will revert all to default keys (at least it did with mine). You can delete and re-install again, it's just an unnecessary hassle. (BTW, it will do that with keys that have been pushed into firmware by Microsoft too.)

So, to summarize: 1: Prepare Bootable USB w/MOSBY, 2: Disable Secure Boot and put it in Setup Mode in BIOS settings, 3: Boot to the USB, run MOSBY, 4: Boot back into BIOS and enable Secure Boot. Done.

BitLocker will probably go into Recovery if using it, so be prepared.

If things go south you can Restore Default Keys to get the default keys restored and Secure Boot back.

News flash! For the "Microsoft CA 2023" certificate being missing, apply the following:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0x1000

Then:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

I found the page with the options:

On this machine I keep seeing InProgress and never goes to Updated status.