windows 10 iso file with ca 2023

FIREMEDIC2700 · 2026-06-27T12:39:55-0400

garlin said:
Rufus creates two volumes, a private one for booting from USB and another that holds the actual Windows install contents.

It looks like Rufus is enforcing an arbitrary rule to only install CA 2023 boot files for W11 25H2 images. Technically any updated W10 ESU or W11 install image has the CA 2023 boot files, because the Monthly Updates push the same CA 2023 files across all currently supported Windows releases.

The exception would be W11 21H2, which reached End of Life and stopped receiving more recent updates. But if you have a latest image created by UUP dump, it should have the latest CA 2023 files.

But I can understand why you want to avoid the headache of confirming if someone's ISO doesn't have the proper versions. You could have a slightly out-of-date ISO that has CA 2023 files, but the SVN number is behind. So if you tried booting this ISO (based on the files provided by the host or the ISO), it could possibly fail on another PC where someone already revoked PCA 2011 and the SVN is now higher than what you have.

Let's try this workaround:

1. Create a W10 image (19045.7417 or later) using UUP dump, but edit ConvertConfig.ini before starting:

Code:

UpdtBootFiles=1

This creates an image where the boot file is already replaced.

2. Use Rufus, but don't select the CA 2023 option. It will write your (pre-updated) image as-is to the USB drive.

GARLIN . in rufus there is no option for the ca 2023 for a windows 10 iso i have already tried the upp dump with convertconfig update boot files to 1

garlin · 2026-06-27T12:44:29-0400

FIREMEDIC2700 said:
GARLIN . in rufus there is no option for the ca 2023 for a windows 10 iso i have already tried the upp dump with convertconfig update boot files to 1

In that case you just have Rufus create the USB normally.

FIREMEDIC2700 · 2026-06-27T12:47:27-0400

XxXxX said:
yes it can be done that way.
save the whole Rufus Win11 ISO to a folder
burn the Rufus USB with Win10

then remove (cut/copy) the Win10 boot folders out
and replace with the Win11 boot folders

i keep a copy of a whole Rufus USB Win11 25H2 with the Win10 boot folders in OneDrive.
that way i can download the Rufus ISO and upgrade a Win10 within the VM install
while the VM is running. it just uses OneDrive as a dropbox.

best of luck Steve ..

ok which one should i copy to the folder i created to the desktop iso k has windows 11 iso made by rufus

FIREMEDIC2700 · 2026-06-27T12:51:33-0400

garlin said:
In that case you just have Rufus create the USB normally.

i have done that and it does not add the ca 2023 file and when it tries to boot up in sercue boot it throws the error of something boot signature or something

XxXxX · 2026-06-27T12:59:53-0400

after you have burned the Rufus USB you can open it in Explorer

here is a picture of my Rufus USB folder
the boot folder is the first folder

best of luck Steve

FIREMEDIC2700 · 2026-06-27T13:19:16-0400

XxXxX said:
after you have burned the Rufus USB you can open it in ExplorerView attachment 175381

here is a picture of my Rufus USB folder
the boot folder is the first folder

best of luck Steve

so i just copy the rufus boot folder from rufus drive and copy it into the windows 10 . sorry this is very confusing to me .

FIREMEDIC2700 · 2026-06-27T13:31:33-0400

ok Garlin here is a screen shot of what rufus is saying when i try to create a windows 10 iso from the microsoft website (not using UPP dump)

XxXxX · 2026-06-27T13:48:36-0400

FIREMEDIC2700 said:
so i just copy the rufus boot folder from rufus drive and copy it into the windows 10 . sorry this is very confusing to me .

1. from the Rufus Win10 USB cut/paste (remove) the boot folder
2. from the Rufus Win11 USB (folder) copy and paste the boot folder to the Win10 USB

best of luck Steve ..

FIREMEDIC2700 · 2026-06-27T13:59:00-0400

XxXxX said:
1. from the Rufus Win10 USB cut/paste (remove) the boot folder
2. from the Rufus Win11 USB (folder) copy and paste the boot folder to the Win10 USB

best of luck Steve ..

ok making a rufus 10 iso right now . will report back in a few

FIREMEDIC2700 · 2026-06-27T14:23:02-0400

would not work for me aboout to just say forget it .

FIREMEDIC2700 · 2026-06-27T14:30:58-0400

FIREMEDIC2700 said:
would not work for me aboout to just say forget it .

i sent u a direct message sir did u get it

XxXxX · 2026-06-27T15:55:15-0400

FIREMEDIC2700 said:
i sent u a direct message sir did u get it

yes i received your messages and answered them.

right i have to report failure.
i made a Rufus Win10 USB and already have a Rufus Win11 USB
i changed all boot folders and EFI files and then restarted the system

the system with secure boot enabled gave an error message and refused to load the Rufus USB because of a secure boot violation
i then went into the BIOS and disabled secure boot, restarted the system and the Rufus USB loaded to the install/setup screen.

so its looking like anybody wants to install or reinstall Windows 10 with the new secure 2023 certs is going to have too disable secure boot.

please except my apologises for the failure
best of luck Steve ..

garlin · 2026-06-27T15:57:46-0400

You might have to try VenToy.

XxXxX · 2026-06-27T16:02:16-0400

garlin said:
You might have to try VenToy.

VenToy on my system also comes up with secure boot violation
if i disable secure boot VenToy will load.

but i am wondering would a secure boot shim work within the boot/EFI folders
using another boot loader such as GRUB to kick start the Windows install.

edit. playing with something will report back in a few hours ..
best of luck Steve ..

FIREMEDIC2700 · 2026-06-27T16:33:42-0400

same here :
A BIG THANK YOU GOES TOXxXxX and garlin for trying to help me .
glad to know i am not the only one that was getting the error.
i have tried ventoy , rufus , and upp dump with the convert config update boot =1 .
can confirm all work with secure boot off during install , but when secure boot is enable will not boot.
i bet it will be the same thing if u tried windows 10 ltsc. looks like a lot of people are going to be mad that run dual os systems on secure boot when ms finally removes ca 2011. something tells me that winows 10 ltsc will have the same issue. and i bet the wife and cats that ms will not make a iso for win 10 with ca 2023 .

spapakons · 2026-06-27T16:35:23-0400

XxXxX said:
yes i received your messages and answered them.

right i have to report failure.
i made a Rufus Win10 USB and already have a Rufus Win11 USB
i changed all boot folders and EFI files and then restarted the system

the system with secure boot enabled gave an error message and refused to load the Rufus USB because of a secure boot violation
i then went into the BIOS and disabled secure boot, restarted the system and the Rufus USB loaded to the install/setup screen.

so its looking like anybody wants to install or reinstall Windows 10 with the new secure 2023 certs is going to have too disable secure boot.

please except my apologises for the failure
best of luck Steve ..

There is no use trying to fix the Windows 10 Setup USB flash drive. Just disable Secure Boot temporarily, clean install Windows 10 22H2, install all drivers including 2023 certificates in the Windows boot disk and then enable Secure Boot again. Lucky me that I run an unsupported computer without Secure Boot and I don't have to deal with all that trouble. As long as I keep Windows Defender updated and watch what I do online, I have no fear using the internet.

FIREMEDIC2700 · 2026-06-27T16:37:16-0400

spapakons said:
There is no use trying to fix it. Just disable Secure Boot temporarily, clean install Windows 10 22H2, install all drivers including 2023 certificates and then enable Secure Boot again.

its not that simple we have tried that . works perfect with secure boot off then when u enable secure boot it gives you a security error . i think if you have not revoked your Microsoft Windows Production PCA 2011 cert. you will be able to boot in secure . to come to think of it i was bootinig into windows 10 before i revoked mine.

XxXxX · 2026-06-27T17:18:24-0400

@garlin
can the Windows 11 DBX certs be inserted/installed into a Windows 10 system after the Win10 has been installed.

reason.
install Windows 10 with secure boot disabled.
install the Windows 11 DBX certs in to Windows 10

restart and re-enable secure and restart the system
as both Win10 and Win11 both have the DBX files that should stop any secure boot violations.

at this time i have not found a way to install Win10 via a Rufus or VenToy USB with secure boot enabled
best of luck Steve ..

garlin · 2026-06-27T17:58:29-0400

The CA 2023 certs are the same, because they belong to the UEFI and not to Windows.

What can be different for each machine is the last version of the DBXUpdate file (typically banning individual non-Windows boot files) and the SVN. If you have the latest version of a W10 or W11 build, the boot manager and SVN should be equal or higher than the SVN already installed in the UEFI.

I haven't tried replicating this issue (I would need to first grab a current W10 image), but it sounds like a boot loader issue. Either the primary boot file is banned for some reason, or it fails when it chain boots into the Windows boot manager file. Both Rufus and Ventoy for different technical reasons don't boot directly from the Windows boot file, they use a non-Windows boot file and then call the Windows boot file in sequence.

MCT on the other hand uses the Windows boot file directly. But as you know, MCT for W10 22H2 no longer hands out updated images. MCT would create a more traditional boot media free of any non-Windows issues, but we can't use it to write a newer ISO to USB. We could use the ADK toolkit, but that's not as convenient as Rufus or Ventoy in getting set up.

I'll try to do some testing after getting a W10 image.

spapakons · 2026-06-27T18:08:21-0400

XxXxX said:
@garlin
can the Windows 11 DBX certs be inserted/installed into a Windows 10 system after the Win10 has been installed.

reason.
install Windows 10 with secure boot disabled.
install the Windows 11 DBX certs in to Windows 10

restart and re-enable secure and restart the system
as both Win10 and Win11 both have the DBX files that should stop any secure boot violations.

at this time i have not found a way to install Win10 via a Rufus or VenToy USB with secure boot enabled
best of luck Steve ..

Much like what I said. Install Windowss 10 with Secure Boot off, install all drivers and 2023 certificates and then enable Secure Boot. It should at least be possible with some third-party tool.

windows 10 iso file with ca 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers