Serious Discussion Secure Boot certificate updates

[Sampei.Nihira]

Read this:

Refreshing the root of trust: industry collaboration on Secure Boot certificate updates

For verification, read this:

How to check if Windows 11 has applied the new Secure Boot 2023 certificates (replaces Secure Boot 2011)

The easiest way to check seems to be with PowerShell.
My PC has not yet received the certificate.

 

[7Oz-64]

@Sampei.Nihira (i know you're already saw)

https://www.wilderssecurity.com/threads/windows-secure-boot-certificate-expiration.457486/

 

[Parkinsond]

I do not have SB.

 

[Sampei.Nihira]

I do not have SB.

You mean Secure Boot is disabled?

 

[Parkinsond]

You mean Secure Boot is disabled?

I do not know if it's supported by my cpu or not; it's an old 3rd gen core i5.
In addition, I use legacy mode, not UEFI.
Tried to change the BIOS to UEFI before but installation did not work.

Also I have read about some serious issues if Secure Boot was not properly set

 

[Sampei.Nihira]

Non so se è supportato dalla mia CPU o meno; è un vecchio Core i5 di terza generazione.
Inoltre, utilizzo la modalità legacy, non UEFI.
In precedenza ho provato a cambiare il BIOS in UEFI, ma l'installazione non ha funzionato.

Ho anche letto di alcuni gravi problemi se Secure Boot non fosse impostato correttamente

Do you use Windows 10?

 

[Parkinsond]

Do you use Windows 10?

Windows 11 IoT Ent LTSC

 

[Sampei.Nihira]

Windows 11 IoT Ent LTSC

I assume you are unable to enter the BIOS if you say you have already tried and failed, so check this registry key:



Is it zero?

 

[Parkinsond]

I assume you are unable to enter the BIOS if you say you have already tried and failed, so check this registry key:

View attachment 295701

Is it zero?

It's different here

I can enter BIOS settings and change between legacy and UEFI, but cannot find option for enabling Secure Boot.

 

[Sampei.Nihira]

It's different here

View attachment 295702

I can enter BIOS settings and change between legacy and UEFI, but cannot find option for enabling Secure Boot.

For UEFI + Secure Boot, the disk must be GPT.
Is yours MBR?
Maybe that's why it's not working.
Check it out.

 

[Sampei.Nihira]

To use Secure Boot, you must FIRST (this is important) convert MBR to GPT and then enable UEFI in the BIOS.

 

[Parkinsond]

For UEFI + Secure Boot, the disk must be GPT.

You are right; must be the culprit.
But the option to convert to GPT is grayed.

 

[Sampei.Nihira]

You are right; must be the culprit.
But the option to convert to GPT is grayed.

Use the internal tool:

mbr2gpt

for conversion without data loss.
Search online for instructions.
Then try again to enter the BIOS and make the change.
I have to go now, good luck.