Secure Boot certificates are expiring pt. 2

🔒 Secure Bits 💡

𝗨𝗽𝗱𝗮𝘁𝗶𝗻𝗴 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗼𝗼𝘁 𝗰𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲𝘀 𝗼𝗻 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗦𝗲𝗿𝘃𝗲𝗿 𝗰𝗼𝗻𝘁𝗶𝗻𝘂𝗲𝘀 (𝘱𝘵. 2)

I believe I had to go through the worst-case scenario after all:

✅ GPO trigger → KEK failure

✅ Broadcom idea (upgrade compatibility + delete/rename NVRAM) → VM fails to boot

✅ Fixed the VM → tried again → KEK failure again

✅ Ended up enrolling the missing KEK manually in UEFI

On the other hand I’m glad it went this way, because I can show the “ugly path” too. You might be lucky and stop at part 1. But if you run into VMware + KEK trouble, this is what it can look like.

⸻

🧩 𝗪𝗵𝗮𝘁 𝗵𝗮𝗽𝗽𝗲𝗻𝗲𝗱 𝗻𝗲𝘅𝘁

After the KEK error from part 1, I found Broadcom guidance and community comments suggesting that on some older VMs you can solve missing 2023 Secure Boot variables by upgrading VM compatibility and regenerating the VM’s NVRAM (.nvram).

My demo environment is ESXi 8.0.2 and the VM was already at the highest compatible hardware version, but I tried removing the NVRAM anyway. Bad idea: the VM stopped booting.

⚠️ Test everything first (don’t delete but rename) and proceed carefully — versions and VM history matter.

⸻

🛠️ 𝗥𝗲𝗰𝗼𝘃𝗲𝗿𝗶𝗻𝗴 𝘁𝗵𝗲 𝗩𝗠 (𝗯𝗼𝗼𝘁 𝗳𝗶𝘅)

I didn’t give up. I booted into UEFI and used:

UEFI → Boot from a file → (select volume) → EFI → Microsoft → Boot → SecureBootRecovery.efi

That checked and repaired the UEFI boot configuration and let the VM boot again. Once back in Windows, I was basically in the same situation: Secure Boot was enabled, DB updates looked fine, but the KEK step was still failing.

At that point I accepted the reality: manual time.

⸻

🔧 𝗠𝗮𝗻𝘂𝗮𝗹 𝗲𝗻𝗿𝗼𝗹𝗹𝗺𝗲𝗻𝘁

I followed Broadcom’s manual enrollment approach (link in comments), with one important adjustment: their examples focus on PK, but my problem was KEK.

𝗦𝘁𝗲𝗽𝘀 (𝗵𝗶𝗴𝗵 𝗹𝗲𝘃𝗲𝗹):

1️⃣ Download the required Microsoft certificates (DER files)

2️⃣ Attach a small disk to the VM and copy the certs there

3️⃣ Power off the VM and add advanced parameter:

uefi.allowAuthBypass = “TRUE”

4️⃣ Boot into UEFI → Secure Boot Configuration becomes available

5️⃣ Choose what you need to fix (PK / KEK / DB / DBX) and enroll the correct certificate from the attached disk → Save/commit

6️⃣ Remove uefi.allowAuthBypass afterwards and boot back into Windows

7️⃣ Re-run the Secure Boot update task / let Windows finish remaining steps

⸻

😅 𝗥𝗲𝗮𝗹𝗶𝘁𝘆 𝗰𝗵𝗲𝗰𝗸

Honestly, I spent far more time on this than I expected. Too many overlapping guides and “status/error” breadcrumbs that don’t always lead anywhere, especially in virtualized environments.

If this were always simple, it would really be just: patch → gpupdate & maybe reboot.

⸻

𝗜𝗻 𝗽𝗮𝗿𝘁 𝟯 I’ll focus on how to tell you’re fine, how to detect “stuck in progress,” and how to collect the right event IDs / registry status into something you can report on.

To be continued…