How do I update Secure Boot certificates manually ?

[Jacky_BEL]

I am reading that a lot of PC's have certificates dating from 2011 that are to expire in 2026.

I can get to the Key management in the (ami) BIOS , but how the heck can I manually update or add 2023 certificates ?

Has anyone here already been succesful in doing so ?


(The PC is an off the shelf office PC , with text style ami BIOS , not with a graphical UI.)
AMI APTIO version 2.21.1278 2.17.1254

 

[chrcoluk]

I will be surprised if its possible without bios modding, planned obsolescence and all that.

 

[R-T-B]

This is a tough one. You can't just use someone elses certs, because there is a very large chance your firmware is signed with the old ones somewhere and it'll refuse to boot.

The good news is to my knowledge, expiration is not enforced on most older boards. So most of them will just continue to work as if nothing happened. AMI Aptio is a reference bios, so almost certainly won't care as the original AMI builds don't.

I will be surprised if its possible without bios modding, planned obsolescence and all that.

Nah, no modding needed, theres an interface to plug in your own certs. The issue is you'll never get any that also sign any uefi code in your particular bios, if applicable.

 

[Jacky_BEL]

The way I understand how it works is that a Platform Key is needed from the OEM , and two updated Secure Boot certification files from Microsoft that I already have downloaded (KEK cert , and a .db file)

I just can't figure out how to get the BIOS to update from these files.

 

[mb194dc]

You don't?

Don't need to do anything if you're getting updates.

Act now: Secure Boot certificates expire in June 2026 - Windows IT Pro Blog

Learn how to update to the new 2023 Secure Boot certificates ahead of June 2026 expiration.

techcommunity.microsoft.com

 

[Jacky_BEL]

Updates are coming for W10 / W11. Microsoft made Secure Boot available for W7 with an update not long before W7 went unsupported.
I have a i7-6700 machine i would like to keep running on W7 ( with updated Secure Boot if possible ) , so that is why i am eager to know.

Maybe as a work around , swap to a W10 install and let the MB get the update , and then swap back to the W7 disk ?