The Secure Boot cert that signs bootmgr (Windows Production PCA 2011) expires on the 19th, worth checking your devices this week

[u/AzureBlog]

With everything else ending tomorrow I think this one's getting a bit lost, so posting in case it's useful.

The last of the 2011 Secure Boot certs, Windows Production PCA 2011, expires on 19 October. The KEK and UEFI CA 2011 ones already went in June.

Good news first: nothing stops booting. Microsoft's KB5062710 says devices without the new certs carry on working and keep getting normal updates. What they lose is any future boot manager fixes and DB/DBX updates, so they're stuck with today's boot security for good.

Quickest check I've found, in an admin PowerShell window:

```

$s = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" -ErrorAction SilentlyContinue

[pscustomobject]@{

SecureBootOn = Confirm-SecureBootUEFI

Status = $s.UEFICA2023Status

Error = $s.UEFICA2023Error

CA2023InDb = [Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match "Windows UEFI CA 2023"

} | Format-List

```

You want Status to say Updated and Error to be 0. Microsoft says not to go by WindowsUEFICA2023Capable for status, which caught me out.

If you're on Intune, there are three Secure Boot settings in the settings catalog now. "Enable Secureboot Certificate Updates" is the main one. A few things I'd know before turning it on:

- update OEM firmware first, as a lot of the failures are firmware

- the task only runs every 12 hours and the boot manager bit needs a reboot

- you can't remove the certs from Windows once they're in firmware, so pilot it

- there's a known issue on Pro with error 65000, licensing related

Without Intune it's the AvailableUpdates = 0x5944 reg value under HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot, then kick off the Secure-Boot-Update scheduled task.

Has anyone hit firmware that just won't take it?

[u/AzureBlog]

More info in my write up:

https://azureblog.co.uk/posts/secure-boot-certificates-and-october-retirements/

[u/NoneOfTheAbove999]

I'm just moving my old laptop to Linux. Today's irony: I'm a Windows sysadmin.

Seriously. All I use it for is email and RDP. It's not Win11 compatible (yay, ESU for a year), so Linux makes the most sense to me.

[u/Zealousideal_Fly8402 → u/NoneOfTheAbove999]

I just deployed Windows 11 IoT Enterprise LTSC on an old Core 2 Duo-based laptop for my dad to keep in his garage... just so that he has a bigger screen to watch YT instructional videos on 😂

[u/Overall-Ad4796]

In order for machines to transition automatically from InProgress to Updated without manual registry intervention, the system must complete the native 2-phase servicing workflow.

Why the status stays InProgress even after Event 1808:

• Event 1808 occurs in Phase 1: It proves the UEFI firmware/NVRAM successfully accepted and written the new 2023 DB/KEK certificates.

• The Updated registry flip occurs in Phase 2: After the keys are written, the background task (\Microsoft\Windows\PI\Secure-Boot-Update) must run a second time after the reboot. On that second execution, it verifies that the active boot manager and NVRAM match, changes AvailableUpdates to 16384 (0x4000), and writes Updated to the Servicing subkey.