Secure Boot Certificates

[RykCave]

My problem is that after buying the windows 10 extended service and running update my HP All-in-One - 22-c0009 (latest Bios installed 8430 vF.56  _ 07/27/2023)

(I get the message that I'm up to date ... Secure boot is on, but your device is using an older boot trust configuration that should be updated.
There is not yet enough data to classify your device for automatic update).

To my chagrin this computer is ineligible for a windows 11 upgrade (yet still works great with windows 10, don't really want to throw it out)

Now I'm not a computer wiz, although (not a total noob) I can follow easy step by step instructions. Is there a way to install the new certificates manually into my Bios?? or can you please collect "enough data to classify my device for an automatic update?"

Thank you for your attention in this matter

[Paul_Tikkanen]

Your PC won't get any BIOS updates for the new certificates because it was made prior to 2018.

See the link below:

HP PCs - Prepare for new Windows Secure Boot certificates | HP® Support

See if you can manually update the secure boot certificates by following the guidance at the link below:

Your Windows Secure Boot Certificates are Expiring Soon: Here's How to Update to the Latest - Make T...

It worked on 3 of my PC's that don't meet the W11 hardware requirements and were made prior to 2018.

If you are interested in doing an in-place upgrade from W10>W11 watch this video which is the easiest way I know of do an in-place upgrade to W11.

How to Install Windows 11 25H2 on Unsupported PCs (New Easiest Method)

[RykCave]

Thank you for the response @Paul_Tikkanen

---

@Paul_Tikkanen wrote:

See the link below:

See if you can manually update the secure boot certificates by following the guidance at the link below:

Your Windows Secure Boot Certificates are Expiring Soon: Here's How to Update to the Latest - Make T...

It worked on 3 of my PC's that don't meet the W11 hardware requirements and were made prior to 2018.

This link mentions ...

"The Windows UEFI CA 2023 certificates are most probably already on your PC. Microsoft actually added these certificates to all PCs with the Windows 11 February 2024 cumulative update, but didn’t activate them"

My question now is since I'm trying to add the certificates in my Windows 10

I imagine that they're not there, yet you mention...

"It worked on 3 of my PC's that don't meet the W11 hardware requirements and were made prior to 2018."

how was that possible? did you first have to do the upgrade to Windows 11 in the way that is suggested in the video link you sent me?

Or is there a way to (download) to get the certificates to work with win10?

[Paul_Tikkanen]

You're very welcome.

I've been running W11 on all of my unsupported PC's since it came out in 2021.

The Powershell commands work on W10 the same way because I ran the first one to check if the 2023 certificates were installed and it reported 'False,' on my only PC that is still running W10.

Running the Powershell commands to manually install the 2023 certificates also works the same way on W10.

But HP for some unknown reason released a BIOS update for the PC that installed the certificates.

The PC is a HP Thin Client t630 which doesn't meet the W11 processor requirements. 

I don't run W11 on it because it has a crazy issue in W11...some of the Windows sounds work fine and some don't work at all.

Other than that quirk, the audio works fine.

I know it is not a big deal, but for now I am leaving it on W10.

So, it's your choice if you want to try the certificate updates on W10, or upgrade to W11 and then do it.

If in the unlikely event things don't work as well on W11 as they do on W10, you have 10 days to easily go back to W10.

How to revert back to Windows 10 from Windows 11 - Pureinfotech

After 10 days has passed, you would have to clean install W10.

I have two PC's that are running W11 and the manual certificate update did not work.

This is the message I got on both PCs:  Secure boot is on, but your device is affected by a known issue. To reduce risk, Secure Boot certificate updates are temporarily paused while Microsoft and partners work toward a supported resolution. The update will resume automatically once resolved.

In W11, you can check the secure boot certificate status by: Go to Settings>Privacy & Security>Windows Security>Device Security>Secure Boot.

[RykCave · Accepted solution]

Okay, here's the latest update

By running the 2 commands (in powershell-admin) a few times

---

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

---

It seems (after 2 restarts and a power off restart) to be sticking and update tells me my security certificates are up to date ... (in W10) Hooray!

I guess the Force was with me 😂