Serious Discussion Secure Boot certificate updates

[Sampei.Nihira]

Read this:

Refreshing the root of trust: industry collaboration on Secure Boot certificate updates

For verification, read this:

How to check if Windows 11 has applied the new Secure Boot 2023 certificates (replaces Secure Boot 2011)

The easiest way to check seems to be with PowerShell.
My PC has not yet received the certificate.

 

[7Oz-64]

@Sampei.Nihira (i know you're already saw)

https://www.wilderssecurity.com/threads/windows-secure-boot-certificate-expiration.457486/

 

[Parkinsond]

I do not have SB.

 

[Sampei.Nihira]

I do not have SB.

You mean Secure Boot is disabled?

 

[Parkinsond]

You mean Secure Boot is disabled?

I do not know if it's supported by my cpu or not; it's an old 3rd gen core i5.
In addition, I use legacy mode, not UEFI.
Tried to change the BIOS to UEFI before but installation did not work.

Also I have read about some serious issues if Secure Boot was not properly set

 

[Sampei.Nihira]

Non so se è supportato dalla mia CPU o meno; è un vecchio Core i5 di terza generazione.
Inoltre, utilizzo la modalità legacy, non UEFI.
In precedenza ho provato a cambiare il BIOS in UEFI, ma l'installazione non ha funzionato.

Ho anche letto di alcuni gravi problemi se Secure Boot non fosse impostato correttamente

Do you use Windows 10?

 

[Parkinsond]

Do you use Windows 10?

Windows 11 IoT Ent LTSC

 

[Sampei.Nihira]

Windows 11 IoT Ent LTSC

I assume you are unable to enter the BIOS if you say you have already tried and failed, so check this registry key:



Is it zero?

 

[Parkinsond]

I assume you are unable to enter the BIOS if you say you have already tried and failed, so check this registry key:

View attachment 295701

Is it zero?

It's different here

I can enter BIOS settings and change between legacy and UEFI, but cannot find option for enabling Secure Boot.

 

[Sampei.Nihira]

It's different here

View attachment 295702

I can enter BIOS settings and change between legacy and UEFI, but cannot find option for enabling Secure Boot.

For UEFI + Secure Boot, the disk must be GPT.
Is yours MBR?
Maybe that's why it's not working.
Check it out.

 

[Sampei.Nihira]

To use Secure Boot, you must FIRST (this is important) convert MBR to GPT and then enable UEFI in the BIOS.

 

[Parkinsond]

For UEFI + Secure Boot, the disk must be GPT.

You are right; must be the culprit.
But the option to convert to GPT is grayed.

 

[Sampei.Nihira]

You are right; must be the culprit.
But the option to convert to GPT is grayed.

Use the internal tool:

mbr2gpt

for conversion without data loss.
Search online for instructions.
Then try again to enter the BIOS and make the change.
I have to go now, good luck.

 

[Sampei.Nihira]

KB5007651 adds more information under Device security > Secure Boot.

 

[Senkei]

KB5007651 adds more information under Device security > Secure Boot.

Do we need to enter the BIOS, reset the secure boot keys, and then re-enter the keys?

How to Enable/Disable Secure Boot | Official Support | ASUS Global

Enabling Secure Boot Control and Restoring Keys for Desktop Computer

 

[Sampei.Nihira]

Do we need to enter the BIOS, reset the secure boot keys, and then re-enter the keys?

How to Enable/Disable Secure Boot | Official Support | ASUS Global

Enabling Secure Boot Control and Restoring Keys for Desktop Computer

Have you installed the update?
Check the information as described:

 

[Senkei]

Have you installed the update?
Check the information as described:

View attachment 296969

i installed it last night via Windows Update.
Secure boot is enabled and all necessary certificate updates have been applied. No further certificate changes are needed.

 

[Miraculix]

I receive the following text: Secure Boot is enabled, but your device is using an older boot trust configuration that needs to be updated. There is not yet enough data to classify your device for an automatic update. See the link below for more information.

 

[lokamoka820]

I do not know if it's supported by my cpu or not; it's an old 3rd gen core i5.
In addition, I use legacy mode, not UEFI.
Tried to change the BIOS to UEFI before but installation did not work.

Also I have read about some serious issues if Secure Boot was not properly set

If you haven't found the answers you need regarding secure boot and BIOS, you can check your device by looking for "BIOS Mode" and "Secure Boot State" values under "System Information."

Do we need to enter the BIOS, reset the secure boot keys, and then re-enter the keys?

No, you don't. All you have to do is:

• Ensure Secure Boot is enabled in UEFI.
• Install Windows Update or feature update—Microsoft’s signatures use the existing Microsoft-signed db/KEK/PK.
• Reboot and let the update finish.

Secure boot is enabled and all necessary certificate updates have been applied. No further certificate changes are needed.

This indicates that everything has been successfully installed.

 

[Parkinsond]

Secure Boot State