Solved TPM/Certificate question

In Event View I just noticed I've been receiving Event 1801 since October 2025 (Events go back to September 2025):

Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection. This device signature information is included here.

I upgraded my BIOS a few months ago from the ASUS Z-590P support site but checked it again this morning and found a newer BIOS so I upgraded to it. I am no longer seeing message 1801 but am now seeing these messages:

Event 7009: A timeout was reached (60000 milliseconds) while waiting for the Intel(R) TPM Provisioning Service service to connect.
Event 18: This event triggers the Trusted Platform Module (TPM) provisioning/status check to run.
Event 1025: The TPM was successfully provisioned and is now ready for use.

Events 18 and 1025 go back as far as Event Viewer will report upon (September 2025). Event 7009 started with today's BIOS upgrade.

I have Secure Boot enabled and I've never had a problem logging on to my system.

Does the absence of event 1801 mean that the newer certs were implemented? Is there a way I can check this?
Does Event 1025 mean that all is well with the TPM provisioning? I searched the Web for answers to Event 7009 (I tried adding ServicesPipeTimeout to the registry but it didn't help).

Rob

OldMainframeGuy said:

Is there a way I can check this?

Click to expand...

Try Method One or Method Three, here...

This is what I see using Method 1. How do I interpret this?

OldMainframeGuy said:

This is what I see using Method 1. How do I interpret this?

Click to expand...

At the bottom of the third post in that topic... do the: SVN Update ...that will fix the SVN items at the bottom.
And also in that third post do this...


The "Secure boot update" will fix the RED "X's" by the CA 2023 items.


It may take up to 12 hours for the Secure Boot update to... kick in.
Depending on the server load at MS.


Always remember... nothing MS does, works well the first time.
And some things don't work well, the third or fourth times either.

Ghot: I ran the processes you asked and then Update_UEFI-CA2023.ps1. Now I see this. To the uninitiated (me) it looks good. Do you agree?



With my experience in working with mainframe certificates, I don't think I *have* to revoke the 2011 cert (maybe Microsoft will do this for me)?

Rob

OldMainframeGuy said:

To the uninitiated (me) it looks good.

Click to expand...

Yes... you did good.
If you want, you can double check with the script you ran in post #3

OldMainframeGuy said:

I don't think I *have* to revoke the 2011 cert

Click to expand...

I believe you are correct.
I revoked mine cause I was bored.

I think that's looking better too:



Thanks for all of your help. This whole thing with certificates reminds me of something my late partner would say. He would have a problem on his PC; I'd fix it, and he'd always say "How are normal people supposed to deal with this"? I hope for most people these certs just magically get installed properly.

Rob