windows 10 iso file with ca 2023

FIREMEDIC2700 · 2026-06-26T06:40:32-0400

hello i have asked in the 10 fourm also .
is there a really simple way to make a windows 10 iso file with the ca 2023. i revoked my 2011 cert and now i cant get win 10 to boot .
i have tried upp dump and change the convert config to 1 also tried the power shell command and no luck

FreeBooter · 2026-06-26T08:21:33-0400

Do you have the Windows 10 update for secure Boot 2023 certificate?

FreeBooter · 2026-06-26T08:36:32-0400

Can you disable Secure Boot so you can boot Windows 10?

garlin · 2026-06-26T10:19:20-0400

W10 22H2 and W11 ISO images have both sets of CA 2011 and CA 2023 boot files. Currently, it's the burden of the ISO->USB app to figure out (or ask the user) which of the two boot files to install on the USB media.

Rufus has a feature where you can specify if you want the old or new boot files.
Media Creation Tool when it directly formats your USB drive doesn't ask, it presumes which one based on the host it's running on.
UUP dump has the config option for "UpdtBootFiles=1"

It's entirely possible that you're creating an USB drive on a host that has different Secure Boot keys than the target system. The source files are already part of the ISO, or on your live Windows system. What the different tools are doing is trying to pick which one of them to copy into \EFI\Boot\bootx64.efi.

FIREMEDIC2700 · 2026-06-26T13:18:11-0400

GARLIN :
I have tried a 3 of the above.
1. i dont see that option in the latest rufus
2. tried uup dump with the updt boot files =1 and that does not work .
3.mct downloads the 2019 cert.

here is your script for the keys :
Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\WINDOWS\system32>

garlin · 2026-06-26T13:22:07-0400

So the problem is you're looking the system's copy of the boot file, and not the USB media.

Run the check script, but add "-BootMedia" to the same command line you used before. This will check any bootable USB drives plugged in.

FIREMEDIC2700 · 2026-06-26T17:54:20-0400

they are showing the 2011 ca garlin . even after a full format then a install. so i dont have a clue.
wish there was a way to just copy the files from the windows 11 install and just paste them into windows 10.
i know i can turn off secure boot and it loads and boots fine. maybe there is not a way to create a 10 iso with the ca 2023 installed.
if anyone has created one please share the details.

garlin · 2026-06-26T18:22:21-0400

W10 22H2 images under the ESU extension are getting the same Secure Boot files as W11.

Have you tried updating the USB drive (while it's plugged in)?

Code:

Update-UEFI.bat -BootMedia

jimminy · 2026-06-26T18:39:14-0400

FIREMEDIC2700 said:
i know i can turn off secure boot and it loads and boots fine.

If that works, it would seem the best choice.

jimminy · 2026-06-26T18:46:07-0400

jimminy said:
If that works, it would seem the best choice.

Microsoft has never made anything that was "secure" for very long.

FIREMEDIC2700 · 2026-06-26T20:58:59-0400

garlin said:
W10 22H2 images under the ESU extension are getting the same Secure Boot files as W11.

Have you tried updating the USB drive (while it's plugged in)?

Code:

Update-UEFI.bat -BootMedia

Yes according to the script its up to date

garlin · 2026-06-26T21:03:58-0400

Are you getting a security violation, or SVN version is wrong?

XxXxX · 2026-06-26T23:37:08-0400

have you tried downloading a new image of Windows 10 from Microsoft

Download Windows 10 Disc Image (ISO File)

then use the latest Rufus to burn this new image to USB stick

Rufus - Create bootable USB drives the easy way

Rufus: Create bootable USB drives the easy way

rufus.ie

best of luck Steve ..

FIREMEDIC2700 · 2026-06-27T01:00:03-0400

XxXxX said:
have you tried downloading a new image of Windows 10 from Microsoft

Download Windows 10 Disc Image (ISO File)

then use the latest Rufus to burn this new image to USB stick

Rufus - Create bootable USB drives the easy way

Rufus: Create bootable USB drives the easy way

rufus.ie

best of luck Steve ..

Yes i have rufus will not create a iso file with the ca 2023 cert for windows 10 . "Rufus features the option to use "Windows CA 2023" signed bootloaders to bypass Secure Boot restrictions. However, this capability is restricted to Windows 11 images (specifically version 25H2 and later). Standard Windows 10 installation media uses older boot files and does not natively support these newer certificates".also tried upp dump with convert config set to updates 1

FIREMEDIC2700 · 2026-06-27T01:01:17-0400

garlin said:
Are you getting a security violation, or SVN version is wrong?

no
just a boot up error that says it willl not support secure boot .

garlin · 2026-06-27T01:46:02-0400

Can you take a screenshot? It's not clear if this is a BIOS screen error, or something the Windows Setup is throwing.

XxXxX · 2026-06-27T02:00:04-0400

Q. do you have a Rufus USB of Windows 11 as well as a Rufus USB of Windows 10
create a folder on the desktop with two folders inside. name them Win10 and Win11

1. from the Win 11 USB copy and paste the all the boot folders from this USB and place in Win11 folder on the desktop
2. then on the Win 10 Rufus USB cut and paste all the boot folders from the USB and place that in the Win10 folder on the desktop
3. from the Win11 desktop folder copy and paste all the boot folders into the Win10 Rufus USB

save and close everything then restart and boot using the Win10 Rufus USB which now has the boot folders from Win11
then see if the system will now install with the secure boot 2023 certs.

i have done this in reverse to install Windows 11 within VM on a Linux system, it worked.
best of luck Steve ..

FIREMEDIC2700 · 2026-06-27T11:42:47-0400

XxXxX said:
Q. do you have a Rufus USB of Windows 11 as well as a Rufus USB of Windows 10
create a folder on the desktop with two folders inside. name them Win10 and Win11

1. from the Win 11 USB copy and paste the all the boot folders from this USB and place in Win11 folder on the desktop
2. then on the Win 10 Rufus USB cut and paste all the boot folders from the USB and place that in the Win10 folder on the desktop
3. from the Win11 desktop folder copy and paste all the boot folders into the Win10 Rufus USB

save and close everything then restart and boot using the Win10 Rufus USB which now has the boot folders from Win11
then see if the system will now install with the secure boot 2023 certs.

i have done this in reverse to install Windows 11 within VM on a Linux system, it worked.
best of luck Stev

i dont have 2 seperate rufus iso sticks only one one stick for windows 11. i will have to save the windows 11. and make a windows 10 . on my windows 11 jump drive i see 2 drives a "K" drive which the iso is in. it has boot files . a "L" drive named rufus with boot files also . which boot files do i need to copy the ones on the "K" drive which is the iso or the "L" drive which is named rufus boot also when i click on the files on the iso i see a boot file and a efi file. on the rufus boot i have to click on the efi folder to get the boot folder on rufus . this is all new to me so excuse my stupidity .

garlin · 2026-06-27T12:15:09-0400

FIREMEDIC2700 said:
Yes i have rufus will not create a iso file with the ca 2023 cert for windows 10 . "Rufus features the option to use "Windows CA 2023" signed bootloaders to bypass Secure Boot restrictions. However, this capability is restricted to Windows 11 images (specifically version 25H2 and later). Standard Windows 10 installation media uses older boot files and does not natively support these newer certificates".also tried upp dump with convert config set to updates 1

FIREMEDIC2700 said:
i dont have 2 seperate rufus iso sticks only one one stick for windows 11. i will have to save the windows 11. and make a windows 10 . on my windows 11 jump drive i see 2 drives a "K" drive which the iso is in. it has boot files . a "L" drive named rufus with boot files also . which boot files do i need to copy the ones on the "K" drive which is the iso or the "L" drive which is named rufus boot

Rufus creates two volumes, a private one for booting from USB and another that holds the actual Windows install contents.

It looks like Rufus is enforcing an arbitrary rule to only install CA 2023 boot files for W11 25H2 images. Technically any updated W10 ESU or W11 install image has the CA 2023 boot files, because the Monthly Updates push the same CA 2023 files across all currently supported Windows releases.

The exception would be W11 21H2, which reached End of Life and stopped receiving more recent updates. But if you have a latest image created by UUP dump, it should have the latest CA 2023 files.

But I can understand why you want to avoid the headache of confirming if someone's ISO doesn't have the proper versions. You could have a slightly out-of-date ISO that has CA 2023 files, but the SVN number is behind. So if you tried booting this ISO (based on the files provided by the host or the ISO), it could possibly fail on another PC where someone already revoked PCA 2011 and the SVN is now higher than what you have.

Let's try this workaround:

1. Create a W10 image (19045.7417 or later) using UUP dump, but edit ConvertConfig.ini before starting:

Code:

UpdtBootFiles=1

This creates an image where the boot file is already replaced.

2. Use Rufus, but don't select the CA 2023 option. It will write your (pre-updated) image as-is to the USB drive.

XxXxX · 2026-06-27T12:35:55-0400

FIREMEDIC2700 said:
i dont have 2 seperate rufus iso sticks only one one stick for windows 11. i will have to save the windows 11. and make a windows 10 . on my windows 11 jump drive i see 2 drives a "K" drive which the iso is in. it has boot files . a "L" drive named rufus with boot files also . which boot files do i need to copy the ones on the "K" drive which is the iso or the "L" drive which is named rufus boot also when i click on the files on the iso i see a boot file and a efi file. on the rufus boot i have to click on the efi folder to get the boot folder on rufus . this is all new to me so excuse my stupidity .

yes it can be done that way.
save the whole Rufus Win11 ISO to a folder
burn the Rufus USB with Win10

then remove (cut/copy) the Win10 boot folders out
and replace with the Win11 boot folders

i keep a copy of a whole Rufus USB Win11 25H2 with the Win10 boot folders in OneDrive.
that way i can download the Rufus ISO and upgrade a Win10 within the VM install
while the VM is running. it just uses OneDrive as a dropbox.

best of luck Steve ..

windows 10 iso file with ca 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers