Solved Successful manual update of Secure Boot on Dell XPS8930 with older BIOS that will never update.

so actually my secure boot setting is disabled and to be able to append thee keys i need it to be enabled. Then I append the keys. When I save it will immediately boot and im not sure if multiple attempts to fix the missing or old keys would cause a catastrophic failure that might require a windows reinstall.

You never have to re-install Windows, if you're only updating the Secure Boot certs. Depending on which signed version of the boot manager you have present on the EFI volume, it may or may not pass Secure Boot authorization.

Which means you temporarily disable Secure Boot mode until you figure out the problem or get the right combination of certs. There's several CA 2023 certs, but the most important one is KEK CA 2023 which undersigns all of the other CA 2023 certs.

The OP in this thread indicated manual key enrollment was possible. Once KEK CA 2023 is onboard, then you have can have the upgrade script install the remaining certs. Focus on that problem (KEK CA 2023 added to the KEK variable).

Hi Garlin, Thanks for the update on needing only the KEK file. I had actually reset the factory keys in an attempt to update this and that is why I put in the warning. After resetting the factory keys, I could not boot. It was a fresh install of Windows 11 Pro on a fresh SSD, so I figured it was part of the process, and why I needed to update the other files.

ok so its probably way to late to make any difference. I followed the instructions that user swohnet gave but when i was appending the files i put all of the ".der" files into the kek database. I didnt realize that and so I thought maybe my system was different, even though we had the same XPS 8930 and same BIOS. So for me i need to do a reset to factory and appending keys in a single BIOS update. The reset acted like freeing up enough space to later handle windows dbx reconstruction. (June 9 th). The manual copying of the files fixes the signature error. But if those steps are done standalone it still might not allow dbx reconstruction to occur if the reset to factory hasnt occured. I just did this today after the July windows update and everything checks out.