Solved Transition to the new Windows UEFI CA 2023 Certificate


IanMosley

IanMosley

Windows Insider
Power User
VIP
Local time
9:19 PM
Posts
1,232
Location
UK
OS
Windows 11 Pro 25H2 (Build 26200.8737)
Does anyone know when this will be available from Microsoft?

Is it enabled in the Windows bootloader components from WinRE/WinPE for Windows 11 25H2 RP Build(26200.6718)? In the GA release to be available next month? Or at some future date?

I've been in touch withe a couple of OEM suppliers:
  • EaseUS - Partition Manager - who said update & see if it works(!!); and,
  • Macrium - Macium Reflect - who said, wait until they receive the updated WinRE/WinPE components from MS.
EDIT
===
It looks as though the Windows UEFI CA 2023 Certificate has already been updated into Build(26200.6718) . . .

1.webp
 
Last edited:

My Computer My Computer

At a glance

Windows 11 Pro 25H2 (Build 26200.8737)Intel Core Ultra 9 285 5.6 GHz32.00 GBIntel Integrated Graphics (128 MB)
OS
Windows 11 Pro 25H2 (Build 26200.8737)
Computer type
PC/Desktop
Manufacturer/Model
Dell Pro Max Tower T2 FCT2250
CPU
Intel Core Ultra 9 285 5.6 GHz
Motherboard
64-bit operating system, x64-based processor
Memory
32.00 GB
Graphics Card(s)
Intel Integrated Graphics (128 MB)
Sound Card
Realtek Audio
Monitor(s) Displays
Dell P2714H Monitor
Screen Resolution
1920 x 1080
Hard Drives
1 x 512GB M.2 XG10d SED KIOXIA PCIe solid state drive (Internal)
1 x 2TB Seagate ST2000DM008-2UB102 HDD (Internal)
1 x 1TB Seagate STGX4000400 External HDD
1 x 4TB Seagate STGX4000400 External HDD
1 x 6TB WD Elements AE 2689 External HDD
PSU
500 Watts
Cooling
Air
Keyboard
Microsoft Wired Keyboard 600
Mouse
Microsoft USB Basic Optical Mouse v2.0
Browser
Firefox
Antivirus
Windows Defender + Malwarebytes Premium
Other Info
BaseBoard Manufacturer Dell Inc.
BaseBoard Product 022RY57
BaseBoard Version A01
MS haven't made an 'official announcement' afaik when the next stage of the rollout will precisely be.

There is already a long thread here that may provide you with further information.

Did you manually update your Secure Boot Keys ?

You are correct, I had to use the Microsoft instructions to actually install the 2023 keys in the EFI boot partition. I did that and then ran the check... Pretty sure all my machines are booting using the 2023 keys. If they weren't, secure boot would be crashing since the Windows 2011 key is...
www.elevenforum.com www.elevenforum.com
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2Intel Core i9 13900KCorsair Dominator Platinum 64gb 5600MT/s DDR5...Sapphire NITRO+ AMD Radeon RX 7900 XTX Vapor-...
    OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Homebuilt
    CPU
    Intel Core i9 13900K
    Motherboard
    Asus ProArt Z790 Creator WiFi - Bios 3107
    Memory
    Corsair Dominator Platinum 64gb 5600MT/s DDR5 Dual Channel
    Graphics Card(s)
    Sapphire NITRO+ AMD Radeon RX 7900 XTX Vapor-X 24GB
    Sound Card
    External DAC: Cambridge Audio DACMagic200M - Headphone Amp: Topping L50
    Monitor(s) Displays
    Panasonic MX950 Mini LED 55" TV 120hz
    Screen Resolution
    3840 x 2160 120hz
    Hard Drives
    Samsung 980 Pro 2TB (OS)
    Samsung 980 Pro 1TB (Files)
    Lexar NZ790 4TB
    LaCie d2 Professional 6TB external - USB 3.1
    Seagate Expansion 16TB external - USB 3.2
    Seagate One Touch 18TB external HD - USB 3.0
    PSU
    Corsair RM1200x Shift
    Case
    Corsair RGB Smart Case 5000x (white)
    Cooling
    Corsair iCue H150i Elite Capellix XT
    Keyboard
    Incase Ergonomic USB (Microsoft clone)
    Mouse
    Logitech MX Master 3S
    Internet Speed
    Fibre 900/500 Mbps
    Browser
    Microsoft Edge Chromium
    Antivirus
    Bitdefender Total Security
    Other Info
    AMD Radeon Software & Drivers 26.1.1
    Hasleo Backup Suite
    Dashlane password manager
    Kensington Verimark fingerprint reader
    Logitech Brio 4K webcam
    Orico 10-port powered USB 3.0 hub

  • At a glance

    Windows 11 Pro 25H2Intel® Core™ i9-13900H32GB DDR4-3200 Dual channel*Intel Iris Xᵉ Graphics G7
    Operating System
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Asus Vivobook X1605VA
    CPU
    Intel® Core™ i9-13900H
    Motherboard
    Asus X1605VA bios 309
    Memory
    32GB DDR4-3200 Dual channel
    Graphics card(s)
    *Intel Iris Xᵉ Graphics G7
    Sound Card
    Realtek | Intel SST Bluetooth & USB
    Monitor(s) Displays
    16.0-inch, WUXGA 16:10 aspect ratio, IPS-level Panel
    Screen Resolution
    1920 x 1200 60hz
    Hard Drives
    512GB M.2 NVMe™ PCIe® 3.0 SSD
    Mouse
    Logitech MX Ergo Trackball
    Antivirus
    Bitdefender Total Security
    Other Info
    720p Webcam
    WiFi & USB to ethernet
IanMosley said:
Does anyone know when this will be available from Microsoft?

Is it enabled in the Windows bootloader components from WinRE/WinPE for Windows 11 25H2 RP Build(26200.6718)? In the GA release to be available next month? Or at some future date?

I've been in touch withe a couple of OEM suppliers:
  • EaseUS - Partition Manager - who said update & see if it works(!!); and,
  • Macrium - Macium Reflect - who said, wait until they receive the updated WinRE/WinPE components from MS.
Click to expand...
I was worried when I first heard of the certificates and not actually remembering what I did, I tried to install the new certificates. When I run the script posted on this forum the results come up true. I'm guessing that I must have done something right. I'm not going to manually go any further. Taking more time to give it more thought I came to the conclusion that MS and the third party software companies will take care of any changes that need to be done. There are way to many Windows users that wouldn't know what to do and I doubt that MS would leave them vulnerable.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2Intel Core i7-10700K16GB (8GB PC4-19200 DDR4 SDRAM x2)NVIDIA GeForce GTX 1050 TI
    OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    PowerSpec B746
    CPU
    Intel Core i7-10700K
    Motherboard
    ASRock Z490 Phantom Gaming 4/ax
    Memory
    16GB (8GB PC4-19200 DDR4 SDRAM x2)
    Graphics Card(s)
    NVIDIA GeForce GTX 1050 TI
    Sound Card
    Realtek Audio
    Monitor(s) Displays
    #1. LG ULTRAWIDE 34" #2. AOC Q32G2WG3 32"
    Screen Resolution
    #1. 3440 X 1440 #2. 1920 x 1080
    Hard Drives
    NVMe WDC WDS100T2B0C-00PXH0 1TB
    Samsung SSD 860 EVO 1TB
    PSU
    750 Watts (62.5A)
    Case
    PowerSpec/Lian Li ATX 205
    Keyboard
    Logitech K270
    Mouse
    Logitech M185
    Browser
    Microsoft Edge and Firefox
    Antivirus
    Webroot SecureAnywhere CE 26.1

  • At a glance

    Windows 11 Canary ChannelIntel Core i5-8400 CPU @ 2.80GHz16 MB DDR 4-2666
    Operating System
    Windows 11 Canary Channel
    Computer type
    PC/Desktop
    Manufacturer/Model
    PowerSpec G156
    CPU
    Intel Core i5-8400 CPU @ 2.80GHz
    Motherboard
    AsusTeK Prime B360M-A
    Memory
    16 MB DDR 4-2666
    Monitor(s) Displays
    23" Speptre HDMI 75Hz
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 970 EVO 500GB NVMe
    Keyboard
    Logitek K270
    Mouse
    Logitek M185
    Browser
    Firefox, Edge and Edge Canary
    Antivirus
    Windows Defender
For the record, the required files have already been part of W10 22H2 and W11, included in the more recent Monthly Updates (since 2024).

Various vendors have different methods for pulling the boot files, some will copy from Windows (via WinRE) or ask you to install the Windows ADK. Frankly with the newer updates installed on your system, they don't need to do that. But they don't know if you've stubbornly not bothered to update Windows (some users are fanatical about it).

The 24H2 (direct download) ISO was never re-released, so it doesn't have the CA 2023-compatible files.
The 25H2 (direct download) ISO is guaranteed to have them, because it's a superset of the updated 24H2 files.

Frankly the backup vendors should get a clue, it's basically copying a few files to your USB recovery drive. I can write a simple script, they can do the same since they're making money off their supported customers. It ain't rocket science.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
For the record, the required files have already been part of W10 22H2 and W11, included in the more recent Monthly Updates (since 2024).

Various vendors have different methods for pulling the boot files, some will copy from Windows (via WinRE) or ask you to install the Windows ADK. Frankly with the newer updates installed on your system, they don't need to do that. But they don't know if you've stubbornly not bothered to update Windows (some users are fanatical about it).

The 24H2 (direct download) ISO was never re-released, so it doesn't have the CA 2023-compatible files.
The 25H2 (direct download) ISO is guaranteed to have them, because it's a superset of the updated 24H2 files.

Frankly the backup vendors should get a clue, it's basically copying a few files to your USB recovery drive. I can write a simple script, they can do the same since they're making money off their supported customers. It ain't rocket science.
Click to expand...
I thought I saw something about this, maybe it was in a script from you. You're getting the files from the EFI partition, right?
 

My Computers My Computers

System One System Two Other systems

  • At a glance

    Win 11 Pro 25H2, Build 26200.8737Intel Core i5 1450064GB DDR4GeForce RTX 4060
    OS
    Win 11 Pro 25H2, Build 26200.8737
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14500
    Motherboard
    Gigabyte B760M G P WIFI
    Memory
    64GB DDR4
    Graphics Card(s)
    GeForce RTX 4060
    Sound Card
    Chipset Realtek
    Monitor(s) Displays
    LG 45" Ultragear, Acer 24" 1080p
    Screen Resolution
    5120x1440, 1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 3D NAND NVMe M.2 SSD (O/S)
    Silicon Power 2TB US75 NVMe PCIe Gen4 M.2 2280 SSD (backup)
    Crucial BX500 2TB 3D NAND (2nd backup)
    Seagate 4TB Ironwolf, rotating HDD archive files
    External off-line backup Drives: 2 NVMe 4TB drives in external enclosures
    PSU
    Thermaltake Toughpower GF3 750W
    Case
    LIAN LI LANCOOL 216 E-ATX PC Case
    Cooling
    Lots of fans!
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security

  • At a glance

    Win 11 Pro 25H2, Build 26200.8655Intel Core i5 1440032GB DDR5Intel 700 Embedded GPU
    Operating System
    Win 11 Pro 25H2, Build 26200.8655
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14400
    Motherboard
    Gigabyte B760M DS3H AX
    Memory
    32GB DDR5
    Graphics card(s)
    Intel 700 Embedded GPU
    Sound Card
    Realtek Embedded
    Monitor(s) Displays
    27" HP 1080p
    Screen Resolution
    1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 eD NAND PCIe SSD
    Samsung EVO 990 2TB NVMe Gen4 SSD
    Samsung 2TB SATA SSD
    PSU
    Thermaltake Smart BM3 650W
    Case
    Okinos Micro ATX Case
    Cooling
    Fans
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security
  • Nimo N171 17" Laptop, (Intel i3-1215U, 16GB RAM, 2TB NVMe, Win11 Pro)
    Acemagic Vista Mini PC V1 (Intel N150, 16GB RAM, 1TB NVMe, Win11 Pro)
    HP ENVY h8-1540t, (24GB RAM, 2TB SSD, 2TB HDD, Win11 Pro)
Every live Windows system or install image has the C:\Windows\Boot\EFI folder.

Several years ago, MS quietly added the EFI_EX and a handful of other _EX folders which include the UEFI CA 2023 versions of the boot files. Because Windows hasn't enforced the ban on the existing CA 2011 certificate, both sets of folders are provided for reference.

When building a bootable disk, vendors can take files from either set of folders (but they must choose between non-EX or EX).

If you wanted to update a previously created USB drive (that's not created by Rufus or Ventoy), then run the command:
Code: 
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi F:\EFI\boot\bootx64.efi

Where F: is the USB drive's current drive letter. To reverse the change (and restore the original boot file):
Code: 
copy C:\Windows\Boot\EFI\bootmgfw.efi F:\EFI\boot\bootx64.efi
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
I didn't realize there were that accessible, even easier to fix bootable USB drives.
 

My Computers My Computers

System One System Two Other systems

  • At a glance

    Win 11 Pro 25H2, Build 26200.8737Intel Core i5 1450064GB DDR4GeForce RTX 4060
    OS
    Win 11 Pro 25H2, Build 26200.8737
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14500
    Motherboard
    Gigabyte B760M G P WIFI
    Memory
    64GB DDR4
    Graphics Card(s)
    GeForce RTX 4060
    Sound Card
    Chipset Realtek
    Monitor(s) Displays
    LG 45" Ultragear, Acer 24" 1080p
    Screen Resolution
    5120x1440, 1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 3D NAND NVMe M.2 SSD (O/S)
    Silicon Power 2TB US75 NVMe PCIe Gen4 M.2 2280 SSD (backup)
    Crucial BX500 2TB 3D NAND (2nd backup)
    Seagate 4TB Ironwolf, rotating HDD archive files
    External off-line backup Drives: 2 NVMe 4TB drives in external enclosures
    PSU
    Thermaltake Toughpower GF3 750W
    Case
    LIAN LI LANCOOL 216 E-ATX PC Case
    Cooling
    Lots of fans!
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security

  • At a glance

    Win 11 Pro 25H2, Build 26200.8655Intel Core i5 1440032GB DDR5Intel 700 Embedded GPU
    Operating System
    Win 11 Pro 25H2, Build 26200.8655
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14400
    Motherboard
    Gigabyte B760M DS3H AX
    Memory
    32GB DDR5
    Graphics card(s)
    Intel 700 Embedded GPU
    Sound Card
    Realtek Embedded
    Monitor(s) Displays
    27" HP 1080p
    Screen Resolution
    1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 eD NAND PCIe SSD
    Samsung EVO 990 2TB NVMe Gen4 SSD
    Samsung 2TB SATA SSD
    PSU
    Thermaltake Smart BM3 650W
    Case
    Okinos Micro ATX Case
    Cooling
    Fans
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security
  • Nimo N171 17" Laptop, (Intel i3-1215U, 16GB RAM, 2TB NVMe, Win11 Pro)
    Acemagic Vista Mini PC V1 (Intel N150, 16GB RAM, 1TB NVMe, Win11 Pro)
    HP ENVY h8-1540t, (24GB RAM, 2TB SSD, 2TB HDD, Win11 Pro)
gunrunnerjohn said:
I didn't realize there were that accessible, even easier to fix bootable USB drives.
Click to expand...

Yup. Then you'll see this in your report (when they're plugged in).

1758864194775.webp
 

My Computers My Computers

System One System Two Other systems

  • At a glance

    Win 11 Pro 25H2 26200.8737Intel® Core™ i7-14700KG.SKILL Ripjaws S5 Series 64GB (2 x 32GB) DDR5ASUS GeForce RTX 4070 Super 12GB
    OS
    Win 11 Pro 25H2 26200.8737
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel® Core™ i7-14700K
    Motherboard
    ASUS TUF Z690-PLUS WIFI (BIOS 4505)
    Memory
    G.SKILL Ripjaws S5 Series 64GB (2 x 32GB) DDR5
    Graphics Card(s)
    ASUS GeForce RTX 4070 Super 12GB
    Sound Card
    Sound Blaster AE-5 Plus
    Monitor(s) Displays
    ASUS TUF Gaming 27" 2K HDR Gaming
    Screen Resolution
    2560 x 1440
    Hard Drives
    Samsung 990 Pro 1TB NVMe (Win 11 25H2)
    SK hynix P41 500GB NVMe
    SK hynix P41 2TB NVMe (x3)
    Crucial P3 Plus 4TB
    PSU
    Corsair RM850x Shift
    Case
    Antec Dark Phantom DP502 FLUX
    Cooling
    Corsair Nautilus 360 RS AIO
    Keyboard
    Logitech MK 320
    Mouse
    Razer Basilisk V3
    Internet Speed
    750Mbs
    Browser
    Firefox
    Antivirus
    Winows Security
    Other Info
    MR 8.1 Home

  • At a glance

    Win 11 Pro 25H2 26200.8737Intel Core i5-1140064 GB DDR4MSI GeForce RTX 3060 Ventus 2X 12GB
    Operating System
    Win 11 Pro 25H2 26200.8737
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel Core i5-11400
    Motherboard
    Asus TUF Gaming Z590 Plus WiFi (BIOS 2803)
    Memory
    64 GB DDR4
    Graphics card(s)
    MSI GeForce RTX 3060 Ventus 2X 12GB
    Sound Card
    SoundBlaster Audigy Fx V2
    Monitor(s) Displays
    Samsung F27T350
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 980 Pro 1TB
    Samsung 970 EVO Plus 2TB
    Samsung 870 EVO 500GB SSD
    PSU
    Corsair HX750
    Case
    Cougar MX330-G Window
    Cooling
    Thermalright Frozen Edge 240 Black AIO
    Internet Speed
    350Mbps
    Browser
    Firefox
    Antivirus
    Windows Security
  • System Three
    Win 11 Pro 25H2 26200.8737
    ASUS PRIME Z370-P II BIOS 3004 7/12/21
    Intel Core i7-8700 CPU @ 3.20GHz
    32GB DDR4 RAM (4x8)
    iGPU Intel UHD Graphics 630
    Mid-Tower Desktop
You must log in or register to reply here.

Similar threads

Problems encountered when installing Microsoft CA 2023 certificates on HP products with HP Sure Start
Replies
2
Views
752
suatcini54
suatcini54
Solved Fresh Windows 11 25H2 installation(Rufus) with Windows UEFI CA 2023 certificate?
2 3
Replies
40
Views
38K
zapbuzz
zapbuzz

Latest Support Threads

Latest Tutorials

Back
Top Bottom