windows 10 iso file with ca 2023

hello i have asked in the 10 fourm also .
is there a really simple way to make a windows 10 iso file with the ca 2023. i revoked my 2011 cert and now i cant get win 10 to boot .
i have tried upp dump and change the convert config to 1 also tried the power shell command and no luck

Do you have the Windows 10 update for secure Boot 2023 certificate?

Can you disable Secure Boot so you can boot Windows 10?

W10 22H2 and W11 ISO images have both sets of CA 2011 and CA 2023 boot files. Currently, it's the burden of the ISO->USB app to figure out (or ask the user) which of the two boot files to install on the USB media.

• Rufus has a feature where you can specify if you want the old or new boot files.
  
  
• Media Creation Tool when it directly formats your USB drive doesn't ask, it presumes which one based on the host it's running on.
  
  
• UUP dump has the config option for "UpdtBootFiles=1"

It's entirely possible that you're creating an USB drive on a host that has different Secure Boot keys than the target system. The source files are already part of the ISO, or on your live Windows system. What the different tools are doing is trying to pick which one of them to copy into \EFI\Boot\bootx64.efi.

GARLIN :
I have tried a 3 of the above.
1. i dont see that option in the latest rufus
2. tried uup dump with the updt boot files =1 and that does not work .
3.mct downloads the 2019 cert.

here is your script for the keys :
Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.


STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\WINDOWS\system32>

So the problem is you're looking the system's copy of the boot file, and not the USB media.

Run the check script, but add "-BootMedia" to the same command line you used before. This will check any bootable USB drives plugged in.