Secure Boot certificate update possible for a Windows Guest?

[gbohn]

Running a Windows 11 25H2 Guest (on a Windows 11 25H2 Host) with the June MS updates shows the following complaint in the Windows Security section.

Basically, it seems to say that the system doesn't support having it's Secure boot certificate updated for the upcoming removal of old secure boot certificates.

It points you at Windows Secure Boot certificate expiration and CA updates.

Is there a way to get these secure boot certificates updated for the Guests? I assume this really relates to the Workstations virtual  'UEFI Bios'.

(This is using Workstation 17.6.4 on the Host.)

[HansJoachim Ballin]

As I read your reported issue, immediately I checked it on my end. Honestly I didn't used the check box for "Enable secure boot". THen I set the checkmark and after starting my VM (Windows 11 Pro) I couldn't see any difference from the situation prior.
The two images reflect the situation on my system.
I'm also using Windows 11 25H2 Guest (on a Windows 11 25H2 Host).

[goldeneye_007]

Same issue here. Unless Secure Boot concerns you it sounds like from my reading that Windows will continue to work without it, which is ironic given all the PC's that were scrapped because they didn't support it.

[Prajakta Malla]

Hi

For manual update, please refer to this KB https://knowledge.broadcom.com/external/article/438613

Regards

Prajakta

[gbohn]

Thanks. 

I looked at the article you mentioned and had a few questions. I might just be misunderstanding something, but it left me a bit confused.

I have some WIndows 11 Guests that use secure boot, but not Bitlocker. They have full Workstation disk encryption with a Guest TPM added (since Windows 11 needed the TPM for secure boot). I am currently using Workstation 25H2u1.

A) I think this means that this falls under 'scenario 3', which says to "Refer to Update vmx config file section below".

    Scenario 3 is for both "Secure Boot enabled" and "vTPM enabled". I assume this fits because the Windows 11 guest needed the TPM for secure boot. Or does 'vTPM enabled' only mean Bitlocker is being used in the guest?

Under "Update vmx config file" it says

"The .vmx file is typically located in the directory where the virtual machine is created. Add below entry to the .vmx file.

1. Back up all TPM-related application data (e.g., BitLocker recovery key), then take a VM snapshot and suspend or pause TPM application.
2. Shut down the virtual machine.
3. Add uefi.secureBoot.PK.resetOnce = "TRUE" to the .vmx file
4. Start the virtual machine.
5. From the guest OS, verify whether the Platform Key (PK) has been updated."

B) Maybe I'm just missing something, but as I understand it, I can't edit the .vmx file without first removing all snapshots and decrypting the entire VM (since I have full encryption).

     Aside from being a pain, it appears I would have to remove the TPM to be able to decrypt the Guest in the first place.

    So, what is the procedure in my case then? (Fully encrypted Windows 11 Guest with TPM added to the configuration and using Guest secure boot but not Guest Bitlocker)?

C) It wasn't clear to me whether or not I needed to do the steps under "Disk Preparation for Platform Key Update:" with this procedure  ("Update vmx config file section") or if that was only needed for the "Manual update process on Workstation releases" procedure.

[Technogeezer]

Here's what I see after reading the article.

A You are correct, With Secure Boot enabled and the "vTPM enabled" (which means that the virtual Trusted Platform Module device is included in your VM configuration), scenario 3 is the one you should choose. Assuming you're using  Workstation 25H2 or 26H2, use the "Update vmx config file" procedure.  

Having BitLocker enabled just means you need to perform additional steps. You must make sure you have the BitLocker recovery key before starting.  You'll most likely need to perform BitLocker recovery (using Miicrosoft documented procedures)  to recover the use of your VM.

B) If you have encrypted your VM using the partial encryption option (which is the default for Windows 11 VMs) the .vmx file remains in plain text and is editable.

If using full encryption, then yes, you will need to decrypt the VM before adding the line to the .vmx file. The Platform Key being updated is stored in the UEFI variables and not the vTPM. 

Bitlocker enabled is somewhat irrelevant - it just means extra work once you reset the platform key to go through Bitlocker recovery to regain access to your Bitlocker-encrypted Windows VM. 

C)  If you're using the "Update VMX Config File" method to update the PK, you do not need any of the other steps.

------------------------------
Paul Rockwell (technogeezer)
vExpert 2026 (3x)
------------------------------

[gbohn]

Thanks. That worked.

I was under the mistaken impression that the TPM itself needed to be there for it to work.

I ended up removing all the snapshots, removing the TPM, decrypting the fully encrypted VM, making the vmx change, booting the VM, shutting down the VM, re-encrypting the VM, and adding back the TPM hardware.

The Guest Windows 11 started up and within a few minutes said it needed to be rebooted. After that, I no longer see the complaint from Device Security.

Sadly, over time I keep running in to the problem of having to decrypt the entire (fully encrypted) machine just to make some small change to the .vmx and then re-encrypt things again.

Aside from the pain of doing it, you end up having the VM in a decrypted state for a bit, which is not ideal from the perspective of why you wanted to have it encrypted in the first place...

It's too bad that there isn't some easier way to change the .vmx file without decrypting the machine. (In my case I want the drives encrypted too, so the option for encrypting "just the things needed for TPM" isn't an option for me.)

[Technogeezer]

>  (In my case I want the drives encrypted too, so the option for encrypting "just the things needed for TPM"

You might want to consider partial VM encryption (so that the .vmx is not encrypted) and use Bitlocker to let Windows encrypt the virtual hard drive. The extra complication here is that you'll have to deal with Bitlocker (e.g. make sure you keep track of the Bitlocker recovery key and know how to perform Bitlocker recovery if required). 

------------------------------
Paul Rockwell (technogeezer)
vExpert 2026 (3x)
------------------------------

[gbohn]

> You might want to consider partial VM encryption (so that the .vmx is not encrypted) and use Bitlocker to let Windows

> encrypt the virtual hard drive.

Thanks.

 I had thought of that, but I was thinking that there might be a few downsides (but I'm not sure).

A) I was worried that the bitlocker encryption might make the storage space management harder since I assumed Workstation wouldn't be able to see what areas were really free verses used. 

I use the kind of drives that 'grow' as needed and I wasn't sure how that might affect things like Compact, cleanup disks, overall size, etc.

I'm guessing that you can still manually enter a password for the partial encryption case?

B) I guess for Linux there's LUKS encryption, but that might have the same issues as A).

Maybe it's not really a big deal, but those worries originally steered me toward the 'native' Workstation Encryption as a presumably better way to go.

Well, other than the surprising number of times I've found myself wanting to change things in the .vmx...

[Vinitha V Nair]

With Workstation full VM encryption enabled, the vmx file is encrypted on disk and cannot be edited directly with a text editor. You do not need to decrypt the VM or remove snapshots to add the key - use dictTool instead, which is a utility we ship with Workstation specifically for this purpose. It handles the encryption transparently.

From your Workstation install directory,:

dictTool set "<full path to .vmx>" uefi.secureBoot.PK.resetOnce=1

The Platform Key update will be applied automatically after the next power on. No decryption, no snapshot removal, no vTPM removal required.

[gbohn]

> - use dictTool instead,

Thanks! I did not know that existed.

Although not as easy as using a text editor, it sounds like this will be way better than what I was doing.

[Technogeezer]

@Vinitha V Nair thanks for that info about dictTool. I also didn't realize that it could do that. It would be nice if the documentation was updated to indicate that it can work with fully encrypted VMs. 

------------------------------
Paul Rockwell (technogeezer)
vExpert 2026 (3x)
------------------------------

[goldeneye_007]

The link to the .der file doesn't really go anywhere except to a message saying the folder structure has

been reorganized.

[Morc001]

If you mean the GitHub/go.microsoft.com links in the Broadcom KB article, all work for me.

[goldeneye_007]

Maybe they have been fixed.

UPDATE Links confirmed working as of  6-18-2026.