windows 10 iso file with ca 2023

garlin · Jun 27, 2026

You're missing the point. The error is occurring because CA 2011 has already been revoked. All the certs are already in place, so there is a version mismatch due to tightened CA 2023 security and the UEFI is blocking it.

But you are correct that the short term fix is to temporarily disable Secure Boot, install Windows and re-enable it afterwards.

spapakons · Jun 27, 2026

Whatever works. If you can make Windows 10 to boot with the new 2023 certificates after installation, there is no point wasting time trying to fix the USB.

XxXxX · Jun 27, 2026

garlin said:
You're missing the point. The error is occurring because CA 2011 has already been revoked. All the certs are already in place, so there is a version mismatch due to tightened CA 2023 security and the UEFI is blocking it.

But you are correct that the short term fix is to temporarily disable Secure Boot, install Windows and re-enable it afterwards.

i have the 2011 certs as well as the 2023 certs and even changing boot loaders it still gets secure boot violation.
its a bit of a head banger, this one.
best of luck Steve ..

XxXxX · Jun 27, 2026

spapakons said:
Whatever works. If you can make Windows 10 to boot with the new 2023 certificates after installation, there is no point wasting time trying to fix the USB.

thats what i was thinking but somewhere along the line i have a feeling MS has made it nearly impossible to install anything other then Windows 11 with secure boot enabled. bypassing this is not going to be for the faint hearted and i have nearly run out of ideas.
best of luck Steve ..

FIREMEDIC2700 · Jun 27, 2026

i am here to tell u if you have a revoked ca 2011 cert. no matter what u try it will not boot with secure boot enabled. it will boot with secure boot disabbled. i think spapakons is missing that point. there is no way as of yet to install a ca 2023 into a windows 10 iso. it needs to be understood that if u have a revoked ca 2011 cert . windows 10 wil not boot secure. how ever if u still have your ca 2011 cert it should boot secure .

FIREMEDIC2700 · Jun 27, 2026

spapakons said:
Whatever works. If you can make Windows 10 to boot with the new 2023 certificates after installation, there is no point wasting time trying to fix the USB.

ok dont leave us in the dark we are dying to know how your getting a ca 2023 cert into a windows 10 iso . as of now there is no officall win 10 iso out there with the cert preinstalled . it has been confirmed by myself and another that mct , rufus and ventoy will not make it .

FIREMEDIC2700 · Jun 27, 2026

Garlin:
i dont know if this means anything but this is from running the older bo script this is a rufus created iso btw
Bootable Media
--------------
USB K: "ESD-ISO"
Boot File [Microsoft Corporation UEFI CA 2011] is ALLOWED.
boot.wim:2 Boot Manager [Production PCA 2011] is BANNED.
install.esd:1 Boot Manager [Production PCA 2011] is BANNED.
Skipping checks on next 6 images.

garlin · Jun 27, 2026

What build version of W10 are you creating from UUP dump?

FIREMEDIC2700 · Jun 27, 2026

the lateset version .
Cumulative Update for Windows 10 Version 22H2 (19045.7417) amd64

Monika1491 · Jun 27, 2026

I'm not interested in Windows 10, I'm using Windows 11.

But I did a little test.
vmware workstation - PK + KEK + DB only Windows UEFI CA 2023

Windows 10 MVS iso October 2025
Structure boot.wim and install.wim 2023 OK.
Copied files 2023 (bootx64.efi etc.) to installation medium.
Created iso.

Starting Windows 10 installation OK.
Copying OK.
Restart.
And Windows 10 doesn't boot.

My findings why it doesn't boot, two reasons:

1)
Windows 10 doesn't have a real valid bootmgfw_EX.efi
In Windows 11, the difference between bootmgfw.efi and bootmgfw_EX.efi is only in the signature.
In Windows 10, bootmgfw_EX.efi is probably from Windows 11, but it is incompatible for booting Windows 10. In addition, it may be somehow corrupted. The difference between them can be seen in the size, ex is much larger.

2)
When installing Windows 10, regardless of whether the installation is run in 2011 or 2023 mode, it copies the 2011 version to the EFI partition.
Even if EX (the one from Windows 10 or Windows 11) is copied to EFI, it won't help because it is not compatible with Windows 10.

Verdict.
Windows 10 will probably never boot with Secure Boot in 2023 mode.

garlin · Jun 28, 2026

There are two different 19045.7417 images on UUP dump:

Cumulative Update for Windows 10 Version 22H2 (19045.7417) amd64

SSU-19041.7402-x64.cab
Windows10.0-KB5015684-x64.cab -> 22H2 Enablement Package
Windows10.0-KB5094127-x64.cab -> W10 Monthly Update (Jun 2026)

Feature update to Windows 10, version 22H2 (19045.7417) amd64

SSU-19041.7402-x64.cab
Windows10.0-KB5015684-x64.cab -> 22H2 Enablement Package
Windows10.0-KB5074207-x64.cab -> Setup DU (Jan 2026)
Windows10.0-KB5094127-x64.cab -> W10 Monthly Update (Jun 2026)
Windows10.0-KB5094154-x64.cab -> SafeOS (Jun 2026)

If you picked the "Cumulative Update", it doesn't include all of the Setup updates.

When UUP dump gives you a choice of two versions of the same build number, check "Browse list of updates" on the third screen. The option with the longer list of updates is usually the one you really want.

1. Run the UUP dump script from the 2nd URL withUpdtBootFiles=1

2. Confirm our image is the expected build:

Code:

PS C:\Users\GARLIN\Downloads> .\CorrectVersion.bat F:\sources\install.wim

Index Name           Arch Edition      Current UBR
----- ----           ---- -------      -----------
   1  Windows 10 Pro x64  Professional 19045.7417

3. Confirm our W10 22H2 ISO is CA 2023 compliant:

Code:

PS C:\Users\GARLIN\Downloads> .\Check_UEFI-CA2023.ps1 -Verbose -BootMedia
...

Bootable Media
--------------
    DVD Drive F: "CPRA_X64FRE_EN-US_DV5"
        Boot File [Windows UEFI CA 2023] is ALLOWED.
            F:\EFI\Boot\bootx64.efi
            File Version: 28000.342, SVN 9.0

        boot.wim:2    Boot Manager [Windows UEFI CA 2023] is PRESENT.
        install.wim:1 Boot Manager [Windows UEFI CA 2023] is PRESENT.

I believe if you use Rufus on this ISO, it would boot just fine.

garlin · Jun 28, 2026

Monika1491 said:
Windows 10 will probably never boot with Secure Boot in 2023 mode.

W10 ESU is extended to Oct 2027. Obviously Secure Boot mode is supported (and works) on W10 22H2 and its Server variants.

The last pre-ESU LCU on Oct 2025 already provided the CA 2023 boot files for everyone who wasn't migrating to ESU. The difference is pre-ESU clients are trapped at the earlier SVN of 5.0. And ESU clients will continue to receive the later boot manager fixes.

FIREMEDIC2700 · Jun 28, 2026

thanks garlin i will try what u suggest . in the process of messing around today i messed something up . i had to reset my custom keys . i have not revoked the pca 2011 yet . maybe i will just wait and see if ms does it on its own .

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN 9.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

REQUIRED ACTION
===============
To REVOKE the [PCA 2011] cert, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

garlin · Jun 28, 2026

Whether you clear PCA 2011 from your DBX to delay revocation is up to you. But with a properly prepared install image you should be able to re-install W10 22H2 after the CA 2011 revocation has happened.

The ESU program wasn't created for normal users in mind. It's for large businesses, schools or organizations that have legacy software and can't easily move from W10 to W11. They desperately want the extra time so they can keep working on a migration plan. It's because the European Union browbeated MS into allowing non-contract users into the ESU program at low (or no-cost) terms, that everyone else gets to benefit.

For those large customers, who don't get ESU for free (they get billed per Windows seat), some of them actually expect Secure Boot to be working as long as they're paying MS. And October 2027 takes us past the 2026 expiration date for PCA 2011.

XxXxX · Jun 28, 2026

good news, i have done it.
i now have a Rufus bootable USB pen drive with Win10 22H2 booting to the install window using the Win11 25H2 bootloader
with no secure boot violations with the new secure boot 2023 cert being used for the install of Win10 22H2.

you can use Win10 and Win11 ISO's if you have already downloaded them to create the Rufus bootable USB pen drive
or you can use Rufus to download the Win10 and Win11 ISO's if you dont have them already.

first.
you will need a 16GB USB pen drive (8GB isnt big enough)
the latest copy of Rufus from the Microsoft Store.

### Part A ###
this is using Rufus to download the Win10 22H2 ISO
then create a bootable USB pen drive from this download.

once the download has completed and the bootable Win10 USB pen drive has been created
open explorer and from within the Win10 USB drive CUT and PASTE 2 folders to the desktop
Sources folder
Support folder

the Sources folder is about 5.7GB
the Support folder is about 316.9KB

### Part B ###
this is using Rufus to Download the Win11 25H2 ISO
then create a bootable USB pen drive from this download.
an option window will open tick any or all options you require but make certain you enable/tick
>>> 'use 2023 secure boot option' <<<

once the download has completed and the bootable Win11 USB pen drive has been created (using the same USB pen drive)
open explorer and from within the Win11 USB drive DELETE these 2 folders
Sources folder
Support folder

### ###
then copy and paste from the desktop the 2 folders (Sources and Support) that came from the Win10 USB pen drive
into the Win11 bootable USB pen drive.

once this has finished transferring the folders from the desktop to the Rufus bootable pen drive
close all open windows and restart the system
then on restart bring up the boot menu and boot from this Rufus bootable pen drive

it will take a few seconds but the Win10 22H2 install window will appear
and from there you can install Windows 10 22H2 with secure boot enabled and the new 2023 certs in place.

best of luck Steve ..
edit by me to add a detail that i missed.

FIREMEDIC2700 · Jun 28, 2026

garlin :
one question for you does
UEFI DBX Certs
--------------
does Windows BootMgr SVN 9.0 go in here or not i have seen some post that says it does and then some that dont . can u clear it up please

Monika1491 · Jun 28, 2026

@garlin

F:\EFI\Boot\bootx64.efi File Version: 28000.342, SVN 9.0
boot.wim:2 Boot Manager [Windows UEFI CA 2023] is PRESENT
install.wim:1 Boot Manager [Windows UEFI CA 2023] is PRESENT

Yes, Windows 10 has bootmgfw_EX.efi files from Windows 11 signed with 2023 certificate.

...Obviously Secure Boot mode is supported (and works) on W10 22H2...

I'm confused.
If I disable Secure Boot and copy files to the EFI partition in Windows 10:

Code:

mountvol S: /S
Xcopy "c:\Windows\Boot\EFI_EX\bootmgfw_EX.efi" "S:\EFI\Boot\bootx64.efi" /Y
Xcopy "c:\Windows\Boot\EFI_EX\bootmgfw_EX.efi" "S:\EFI\Microsoft\Boot\bootmgfw.efi" /Y
mountvol S: /D

and then enable Secure Boot, then Windows 10 boots in 2023 mode.
Windows 10 installation creates an EFI partition with files signed with a 2011 certificate, even if the installation is run in 2023 mode. Interestingly... Still figuring out how to solve it

Scott · Jun 28, 2026

FIREMEDIC2700 said:
one question for you does
UEFI DBX Certs
--------------
does Windows BootMgr SVN 9.0 go in here or not i have seen some post that says it does and then some that dont . can u clear it up please

It's just the area where he chose to display it. It doesn't mean it's banned.

XxXxX · Jun 28, 2026

@FIREMEDIC2700
i have created the Rufus bootable Win10 22H2 USB pen drive
and it will arrive with you as soon as possible.

best of luck Steve ..

garlin · Jun 28, 2026

Scott said:
It's just the area where he chose to display it. It doesn't mean it's banned.

Correct. The DBX variable handles multiple responsibilities in that it can store 3 different types of values:

Banned signing certs like "Microsoft Windows Production PCA 2011".

These are stored as complete X509 certificates. If any boot file is signed by one of these certs, it's blocked regardless of the file's version.
Banned EFI signature hashes, which represent boot files which are banned by taking a computed hash of the actual file's signing certificate.

If any boot file's computed hash matches of the listed EFI signature hashes, it's blocked regardless of its certificate status.
SVN's for each of the three boot manager types: Windows Boot Manager (disk), DVD (DVD-only) and WDS (network boot).

While the SVN is listed in [Major].[Minor] number format, they are actually stored in the DBX as fake EFI signature hashes. The boot managers provided by MS will scan all of the DBX signature hashes to find the highest numbered SVN for each defined boot manager type.

The SVN for Windows Boot Manager doesn't have to match the SVN for DVD boot, nor the SVN for network boot.

Every "modern" MS boot manager will check its internal SVN against the highest SVN for the same type. If this SVN is lower than the DBX's assigned value, then the boot manager halts and throws a security error This decision is entirely in the control of the boot manager, and not enforced by UEFI itself (unlike for banned signing certs or EFI hashes).

For a lack of a convenient landing spot, the UEFI's Windows Boot Manager SVN ended up under the DBX category because that's how SVN's are stored. They're not a banned value but are associated by living inside the same variable.

windows 10 iso file with ca 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer