I followed procedure to revoke Microsoft 2011 PCA certificate, which revokes it in UEFI/BIOS and going forward my motherboard's Secure Boot only allows me to boot Windows media that meets 2 specific criteria: 1. Bootloader is signed with 2023 certificate 2. MS PCA 2011 certificate is not trusted That works fine for install.wim (for a live image that is already installed), but not for boot.wim, winre.wim, and not for anything that uses boot.wim and/or winre.wim (such as Macrium Reflect). Boot managers for boot.wim and winre.wim are also signed with 2023 certificate, but the trust in MS 2011 PCA certificate is still there. My BIOS/UEFI Secure Boot is not going to load boot.wim, winre.wim, or any image that uses those WIM files because of that MS 2011 PCA certificate trust. I have to temporarily disable Secure Boot to load such images, but that is an inconvenience I'd rather not have. Can MS 2011 PCA certificate trust not be disabled/removed/revoked for boot.wim and/or winre.wim the same way it can for install.wim? Form what I understand install.wim (live image, post-install) uses "C:\Windows\System32\SecureBootUpdates" directory for signature verification. That directory is not present for boot.wim or winre.wim. How does MS plan to address this? Anyone who fully migrates to 2023 certificate and revokes MS 2011 PCA certificate is going to have the same exact issue as me. They'd be forced to temporarily disable Secure Boot even when re-installing Windows or would be forced to reset, wipe, and reflash motherboard BIOS/UEFI to bring back MS 2011 CPA certificate trust.
The Secure Boot task only takes care of updating Windows. It has no responsibility for updating boot images. 1. If you're using UUP dump, specify UpdtBootFiles=1 flag in ConvertConfig.ini when creating the image. This forces the script to copy the CA 2023 boot manager in the right places. 2. If you're downloading a MCT or direct download ISO, you can use Rufus or another tool to switch the boot manager (CA 2023 boot option) when it creates the USB volume. 3. If you're using Macrium (especially Macrium 8 Free), you're at the mercy of the backup vendor in providing a source WinPE or WinRE image which is properly up to date. Later Macrium X and Hasleo apps do a better job of providing an updated boot.wim source. If you use the current WinRE as your source, it should be CA 2023 compliant. Macrium 8 Free doesn't have a clue about Secure Boot, so it's up to you to replace the boot manager file (typically copying "\Windows\Boot\EFI_EX\bootmgfw_EX.efi" to be the USB's "\EFI\Boot\bootx64.efi". One day (prolly W11 27H2), Windows will only ship with the CA 2023 boot manager since by that time MS cannot sign any patched boot files using the expired PCA 2011 cert. But for now it's up the user to keep track, since MS cannot guess if the target PC has updated their certs or not.
Thanks, but none of those methods resolve the actual issue of what happens once 2011 PCA certificate is revoked in BIOS/UEFI. Once 2011 PCA certificate is revoked in BIOS/UEFI, Secure Boot only works with images that meet both criteria: 1. Signed with 2023 certificate 2. 2011 PCA certificate is NOT trusted If boot loader is signed with 2023 certificate, but 2011 certificate remains trusted, then Secure Boot will refuse to load the image. The whole "signed with 2023 certificate" is very misleading because it does not mean that 2011 certificate is not trusted and it must be not trusted for Secure Boot to work once 2011 certificate is revoked in BIOS/UEFI. 2011 certificate is supposedly unsafe and if it is trusted, then "signed with 2023 certificate" adds absolutely no benefit to security.
Finally some good news. Yesterday's mandatory update includes boot loaders / boot manager that honors revoked 2011 PCA certification. I can now boot Macrium Reflect and installation media without having to disable Secure Boot, even though 2011 PCA certificate is fully revoked in my BIOS/UEFI.