Whoever solves this Microsoft certificate puzzle, please come forward !!!

This is my computer with Microsoft CA 2023 certificates.



I created a bootable USB flash drive using Microsoft's MCT (media creation tool).

I opted for the default setting "Use recommended options for this computer"



When USB flash drive was ready, I tried to boot off of it. Mind you, bootable USB flash drive was prepared for this computer..



Was my computer able to boot to the bootable USB flash drive created out of MCT ? The answer is a big NO. Was I surprised ? NO.



When I checked the certificate of bootx64.efi file, I saw that certificate of this file was Microsoft Windows Production PCA 2011.



USB flash drive was formatted in FAT32. MCT downloaded Windows 11 25H2 Build 26200.8653 and created the bootable USB flash drive.

If I will not be able to boot to a bootable USB flash drive created with MCT, what am I supposed to do when I need to boot to a USB flash drive ?

Fortunately, my Windows never bluescreens or gets corrupt because I am not a heavy computer user and I never abuse my Windows. I take great care of it.

Does anyone have an idea of what I should have done instead of the above ?

Next time I will try a bootable USB flash drive using famous uupdump.net with updatedbootfiles=1

Update the USB drive using this command.
In this example F: is the drive letter of the USB drive so if needed adjust to whatever the drive letter is of your USB drive.

You can run the check script with the -BootMedia option to check what's on the USB drive.
Or use the update script with -BootMedia.

@KevTech and @garlin Thanks for your prompt responses.

Here are the results:

First check script with bootmedia argument



Now bootx64.efi file replacement:



Now I will try to reboot to USB flash drive and advise the results.

And you cam always turn off secure boot when you need to use a bootable USB that you own.

kelper said:

And you cam always turn off secure boot when you need to use a bootable USB that you own.

Click to expand...

Yes, thanks for the idea. It is always an option at hand. But Microsoft must find ways for us to not go to such extreme measures as disabling Secure Boot.

After replacing the bootx64.efi file with the one in \Windows\boot\EFI_EX\bootmgfw_EX.efi file (renamed to bootx64.efi), my computer was able to boot to the bootable USB flash drive.







So this file copying and renaming must be incorporated into the Media Creation Tool by Microsoft. Maybe Microsoft is waiting for the time to come when Windows Production PCA 2011 will be revoked and eliminated for once and for all.

Happy computing.

I have no idea how Media Creation Tool determines which of the two boot files (CA 2011 or CA 2023) to pick. You would think it checked the host Windows, and copied CA 2023, since you already have the UEFI CA 2023 installed.

Unlike Rufus which provides an explicit option to use CA 2023 boot files, it's not clear if MCT will catch up and explain which boot file it will be using.

While the products.cab changes every month, we're still using the same MCT tool from October 2025.