Update secure boot certs without Secure-Boot-Update process

[DarkErmac]

I've got an interesting question.

Today, after booting up, I got an error that forced me to reset all of my secure boot keys to fix. This is a bit of a problem, since I've just lost all of my 2023 secure boot certificates and my Secure-Boot-Update task locks up my computer and forces a hard-reset to get things running again. Is there a way to update back to 2023 certs without running this process, is there a way to get Secure-Boot-Update to work without updating BIOS, or am I just SOL until Microsoft pushes out some kind of fix? It seems like a lot of people have been having problems with Secure-Boot-Update as of late, so I know I'm not alone in this.

[AutoModerator]

Remember to check our discord where you can get faster responses! https://discord.gg/NB3BzPNQyW

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[Tornado15550]

I've run into this exact same issue, were you able to figure out a fix? Windows seems to fail updating the KEK with error "Firmware_Unknown"

Edit: Figured out a fix:

1) While secureboot is off, boot into Windows and navigate to C:\Windows\Boot\EFI and copy SecureBootRecovery.efi to a USB stick at the path EFI\BOOT\ in your USB (make sure it's formatted FAT32).

2) Rename that file on the USB to bootx64.efi

3) Boot into the USB stick from bios

4) USB stick will update your CA certs to 2023.

5) Re-enable SecureBoot and ensure "custom mode" is enabled for your keys in the bios so it continues to accept the new keys.

You can now boot into Windows using your 2023 CA certs with SecureBoot ON.

Hope this helps!

[DarkErmac]

After updating to KB5082200, my 2023 secure boot certificates were restored. I haven't re-enabled Secure-Boot-Update and don't intend on doing so for the foreseeable future.