Secure Boot Update Issue for 2014 Dell Laptop

I used Method 3 here How to check if your Secure Boot certs are updated. (three methods) to update my 2014 Dell laptop which turned out to be a mistake since the KEK 2023 certificate cannot be enrolled. The PC boots with Secure Boot on but note the comment Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is BANNED. Secure Boot can only be enabled or disabled on this PC. The Reflect recovery media will no longer boot with Secure Boot on. I've now turned secure boot off. Is there a fix for this issue or am I fundamentally limited by the firmware on this 2014 PC?

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

EFI Files
---------
Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is BANNED.

Registry: WindowsUEFICA2023Capable = 2
Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.

You don't have a KEK CA 2023 enrolled (probably because this an "unsupported" legacy PC).
Without the KEK CA 2023, none of the CA 2023 certs are considered valid.

What I would do now:
1. Temporarily disable Secure Boot in BIOS, so you don't get problems for now.

2. Check if your BIOS supports manual UEFI key enrollment, or "Setup Mode". If it does we can either manually install the missing KEK CA 2023, or clear all the certs, and install a substitute set of them from MS (specifically for this purpose). Manual key enrollment is preferred, but you might have to resort to Setup Mode.

garlin said:

You don't have a KEK CA 2023 enrolled (probably because this an "unsupported" legacy PC).
Without the KEK CA 2023, none of the CA 2023 certs are considered valid.

What I would do now:
1. Temporarily disable Secure Boot in BIOS, so you don't get problems for now.

2. Check if your BIOS supports manual UEFI key enrollment, or "Setup Mode". If it does we can either manually install the missing KEK CA 2023, or clear all the certs, and install a substitute set of them from MS (specifically for this purpose). Manual key enrollment is preferred, but you might have to resort to Setup Mode.

Click to expand...

Secure boot is off for now. I do have a secure boot configuration page currently showing:

Protected signatures - Enabled (User Mode)
Customised signatures - Disabled (Standard Mode)
CertNames - Win8 Certificates
Reset to Default [Enter]
Change to Customization [Enter]

How to enroll the missing CEK CA 2023 certificate?

my 2014 Dell laptop

Click to expand...

What is the exact model of the machine ?

I have an ancient hp 8300 sff and a slightly less ancient gigabyte b75 motherboard I wonder if it is possible to do it with those. Haven't had time to look into it yet. I suspect the b75 would be less difficult.

I don't have this model Dell. But I'm going to guess:

See if that unlocks more menu options.

SIW2 said:

What is the exact model of the machine ?

I have an ancient hp 8300 sff and a slightly less ancient gigabyte b75 motherboard I wonder if it is possible to do it with those. Haven't had time to look into it yet. I suspect the b75 would be less difficult.

Click to expand...

It's a Dell Inspiron 15 7537. Based on my experience it's probably too old to fiddle with.

garlin said:

I don't have this model Dell. But I'm going to guess:

- Protected signatures -> Disabled​

- Customized signatures -> Enabled​

See if that unlocks more menu options.

Click to expand...

Those are what is set. I can only select Reset to Default and Change to Customization. Choosing the latter says it will delete all keys and I'm not brave enough to find out what happens then. Copilot advises leaving the PC as it is with Secure Boot off to avoid making the situation worse!

Copilot:
Don’t switch to Customisation Mode on the Inspiron 7537.This model only supports deleting and restoring the old Windows 8 Secure Boot keys — it cannot import or enrol the new Microsoft KEK 2023 certificate.If you delete the keys, you can only restore the original 2011 key set, which still won’t validate the modern CA‑2023 bootloaders.You gain nothing, and you risk temporary boot failures.Secure Boot simply can’t be made CA‑2023‑compatible on this laptop, so the stable solution is to leave Secure Boot turned off.

Might be a workaround to have just one usb stick. Create a second fat32 partition. Copy your macrium media created on the cak 2011 machine to the second partition. Then you could select whichever is appropriate for the machine you are booting the usb stick on.

If you get it to create an iso and deposit it somewhere else it also does all the stuff in %systemdrive%\boot folder which can be copied to the usb stick