VMware vSphere

 View Only
Expand all | Collapse all

UEFI and Secure boot cert update

  • 1.  UEFI and Secure boot cert update

    Posted Mar 02, 2026 10:08 AM

    I would like to clarify what actions, if any, we need to take on our ESXi 8 hosts regarding Secure Boot certificate updates. Specifically, with the Microsoft Secure Boot certificate update (2011 → 2023), do we need to update anything on ESXi itself, or is it sufficient to update the host BIOS/UEFI firmware? Any guidance on the proper steps to ensure our hosts and VMs are using the latest certificates would be greatly appreciated.



    -------------------------------------------


  • 2.  RE: UEFI and Secure boot cert update

    Posted Mar 03, 2026 01:41 AM
    Edited by cloudyMcCloudFace Mar 03, 2026 01:41 AM

    This is a moving beast.

    see this article: 423893

    There is a post on this in the forums here

    There is likely going to be updates for this soon. thing will continue to boot so it's not all doom and gloom.
    recommend a minimum version of 8 Update 3.

    -------------------------------------------



  • 3.  RE: UEFI and Secure boot cert update

    Posted Mar 03, 2026 04:42 PM

    Thank you for the KB article.

    Even though we have updated the firmware, BIOS, and applied the ESXi patches, do we still need to  manual update? 

    -------------------------------------------



  • 4.  RE: UEFI and Secure boot cert update

    Posted Mar 03, 2026 05:30 PM
    Edited by cloudyMcCloudFace Mar 03, 2026 05:30 PM

    ok, I have been digging into this. this is a dumpster fire train wreck.

    There are many levels to this,

    Hardware - right now you should be updating the hardware BIOS, vendors like Dell, HPe are still updating BIOS to support the 2023 chain. if you have BIOS that supports the secure boot updates and you are secure booting ESXi then keep your BIOS up to date.

    Then these will be the VM BIOS, this is being worked on, so Hold here, make no changes yet, but gather the list of VMs that are using Secure Boot, use VCF Ops for this, you need to enable this option.

    Do you have a VMware TAM? if so speak to them.

    -------------------------------------------



  • 5.  RE: UEFI and Secure boot cert update

    Posted Mar 04, 2026 12:40 AM

    Microsoft has a video you can get a lot of information from here https://techcommunity.microsoft.com/event/windowsevents/ask-microsoft-anything-secure-boot---february-2026/4486023

    -------------------------------------------



  • 6.  RE: UEFI and Secure boot cert update

    Broadcom Employee
    Posted Mar 25, 2026 08:50 PM

    What ESXi patches? currently there has not been a release that dual signs ESX boot shims. 

    -------------------------------------------



  • 7.  RE: UEFI and Secure boot cert update

    Posted Mar 05, 2026 03:01 AM

    Good Topic to discuss in this forum

    As per I read about Secure Boot Certificate.

    First thing, BIOS firmware needs to be updated. Once BIOS firmware is updated then Microsoft article will help you to fix the issue.

    As per my understanding, VMware BIOS is .nvram file. Below is the article for VMware Hardware version history which describes about VM nature & you need to find your VM hardware version. It will show as below as sample in your vCenter Server -> Compatibility section

    ESXi 6.7 U2 and later (VM version 15)
    ESXi 7.0 U2 and later (VM version 19)
    vmx-21

    VMware Hardware Version Article -> https://knowledge.broadcom.com/external/article/315655
    VMware Hardware Version Upgrade Article -> https://knowledge.broadcom.com/external/article?legacyId=1010675

    So, it might a requirement to upgrade the BIOS or VMware Hardware version to the latest but It is not mentioned in any VMware article that we need to upgrade to the latest which I didn't find till date. It might be there but I missed to find it out.
    VMware provided below article which is more about troubleshooting steps
    -> https://knowledge.broadcom.com/external/article/423893
    -> https://knowledge.broadcom.com/external/article/423919
    -> https://knowledge.broadcom.com/external/article/424429

    There are many Microsoft article among them I found below article useful & one already mentioned by someone in this thread
    -> https://techcommunity.microsoft.com/blog/windows-itpro-blog/act-now-secure-boot-certificates-expire-in-june-2026/4426856/
    -> https://techcommunity.microsoft.com/event/windowsevents/ask-microsoft-anything-secure-boot---february-2026/4486023

    -------------------------------------------



  • 8.  RE: UEFI and Secure boot cert update

    Posted Mar 07, 2026 10:36 AM

    If I understand correctly, Broadcom is responsible for updating the UEFI firmware, while we must perform tasks within the Windows OS to ensure the boot loader is up to date (specifically the 2023 DBX updates). At a high level, the following steps are required for Windows Server VMs on VMware ESXi:

    Phase 1: VMware / Broadcom

    • Ensure the VM's Secure Boot databases (DB/DBX) are updated to support the new Microsoft certificates.

    Phase 2: Microsoft / Windows

    • Install Windows Updates: Apply the latest cumulative updates.

    • Trigger Revocation: Manually apply the Secure Boot update via the registry or the automated scheduled task.

    Only after both phases are complete will the system be fully prepared for the 2026 Secure Boot certificate transition.

    Am I correct?

    -------------------------------------------



  • 9.  RE: UEFI and Secure boot cert update

    Posted Mar 08, 2026 11:04 PM

    If you have VMs with older Hardware version & Secure boot enabled then test it on your devices or virtual machines. 
    It is found that older VMware Hardware version also having below command as output as "True"

    Command -> :
    Type, in PowerShell -> ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

    So, VMware Hardware version to the latest is not required in above scenarios. Below is the new article or in Microsoft community page with AI assisted Answers 
    https://learn.microsoft.com/en-my/answers/questions/5804878/how-to-manually-force-apply-updated-secure-boot-ce

    But it is good to test in with your environment on test servers where you can play with that machines. Make sure that you have full backup & Snapshot taken in advance. 

    I will suggest to have above steps mentioned by you is still relevant & to make your environment with stable & latest VMware Hardware Version as the priority. You have a chance to make this upgrade during this crucial time as well.

    One more thing, Windows Secure Boot Certificate expiry is only applied to Secure Boot enabled machines. So, if you have disabled machines the read about it as well.
    Many things are going on internet but having latest update or action item is necessity. So, it needs to be explored & tested in your environment & make the solution worked as expected. 

    -------------------------------------------



  • 10.  RE: UEFI and Secure boot cert update

    Posted Mar 09, 2026 01:00 AM

    I tested on my test machine where VMware hardware version is on older version & below command shows value as "True"
    Type, in PowerShell -> ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

    My value is "True" on Older VMware hardware version (vmx-19 -> ESXi 7.0 U2 (7.0.2)) & then Microsoft steps performed as mentioned below

    • reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
    • Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
    • Manually reboot the system when the AvailableUpdates becomes 0x4100
    • Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

    It makes Secure Boot Certificate as updated with event code "1799" & message as "Boot Manager signed with Windows UEFI CA 2023 was installed successfully" in Windows SYSTEM events.

    You can test it in your environment & test the scenario.



    -------------------------------------------



  • 11.  RE: UEFI and Secure boot cert update

    Posted Mar 09, 2026 07:03 AM

    I am testing the Secure Boot certificate transition steps. According to the KB article, we should load WindowsOEMDevicesPK.der as part of the process.

    However, on a test VM I have not loaded WindowsOEMDevicesPK.der, but when I run the following command inside Windows:

    (Get-UEFISecureBootCerts dbdefault).signature

    I can still see UEFI CA 2023 certificate details.

    This VM is running Windows Server with Secure Boot enabled on VMware ESXi 7.

    I am curious why the 2023 certificate is already present even though I did not manually load the file described in the KB article.

    Has anyone seen this behavior or knows if the certificate may already be included by default in the firmware or Windows Secure Boot updates?

    -------------------------------------------



  • 12.  RE: UEFI and Secure boot cert update

    Posted Mar 11, 2026 04:27 AM
    For vSphere 7 there shall be no fix.
    To get it working, you must copy the MS PK & KEK Cert to a small fat32 Disk.vmdk and use this disk later in EFI - Setup for each VM.

    The fix with deleting the .nvram file resulted in my cluster in non-bootable VMs, so i figured out other ways to resolve this...
    The procedure here (in german, translation by yourself):

    Update der Microsoft UEFI 2023 Zertifikate in VMware 7.0.3
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    1. Snapshot der VM erstellen
    *2. erweiterte Optionen -> uefi.allowAuthBypass = "TRUE"
    und Force EFI Setup aktivieren
    *3. die Disk (.vmdk) mit dem PK an die VM hängen und ins Setup Booten
    Disk liegt in vorlagen -> 1ueficert -> admin-2413-02.scc.uni-weimar.de_2.vmdk
    4. UEFI Setup -> Secure Boot Optionen ->
    Enroll PK -> das PK Cert von der Disk auswählen
    Enroll KEK -> das KEK Cert von der Disk auswählen
    5. Windows Booten und Registry Key setzen:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot -> HEX 0x5944
    oder(!): ausführen winCsFlags.exe /apply --key "F33E0C8E002"
    6. nach circa 10 Minuten prüfen (PS als Admin):
    Get-UEFISecureBootCerts db | select SignatureSubject

    [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI KEK).Bytes) -match 'Microsoft Corporation KEK 2K CA 2023'

    Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing |
    >> select WindowsUEFICA2023Capable, UEFICA2023Status, `
    >> @{n="UEFICA2023Error";e={'0x' + '{0:x}' -f $_.UEFICA2023Error}}

    Get-WinEvent -ProviderName Microsoft-Windows-TPM-WMI -MaxEvents 10 |
    where Level -eq 2 | Format-List TimeCreated, LevelDisplayName, Id, Message
    *7. aufräumen:
    die Disk wieder abhängen und die Advanced Option entfernen / false setzen


    Wenn alles OK ist, sollte es so aussehen:

    PS C:\WINDOWS\system32> Get-UEFISecureBootCerts db | select SignatureSubject

    SignatureSubject
    ----------------
    O="VMware, Inc.", L=Palo Alto, S=California, C=US
    CN=VMware Secure Boot Signing, O="VMware, Inc.", L=Palo Alto, S=California, C=US
    CN=Microsoft Corporation UEFI CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
    CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
    CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US
    CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US
    CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US


    PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI KEK).Bytes) -match 'Microsoft Corporation KEK 2K CA 2023'
    True


    PS C:\WINDOWS\system32> Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing |
    >> select WindowsUEFICA2023Capable, UEFICA2023Status, `
    >> @{n="UEFICA2023Error";e={'0x' + '{0:x}' -f $_.UEFICA2023Error}}

    WindowsUEFICA2023Capable UEFICA2023Status UEFICA2023Error
    ------------------------ ---------------- ---------------
    2 Updated 0x

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    References:

    https://www.windowspro.de/wolfgang-sommergut/update-secure-boot-zertifikate-fuer-windows-server-virtuelle-maschinen
    https://knowledge.broadcom.com/external/article/423919
    https://support.microsoft.com/de-de/topic/registrierungsschl%C3%BCsselupdates-f%C3%BCr-den-sicheren-start-windows-ger%C3%A4te-mit-it-verwalteten-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Regards Steffen Ille




  • 13.  RE: UEFI and Secure boot cert update

    Posted Apr 16, 2026 07:28 AM

    Hello

    If your Windows machine shows value as "True" for below PS code then you are good to perform the further steps (4 Steps provided below)

    PS -> ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

    If value is "False" then don't move to further steps (4 Steps provided below).

    The steps, I am referring as below

    • reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
    • Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
    • Manually reboot the system when the AvailableUpdates becomes 0x4100
    • Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

    Reference Articles

    https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d

    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    https://techcommunity.microsoft.com/event/windowsevents/ask-microsoft-anything-secure-boot---february-2026/4486023

    If you perform above 4 steps without checking PS value as "True" then your machine won't get successful status as "Updated" in "Registry"

    Now, moving to your question that you already have certificate available on your machine. I am not aware about that but it might be coming through Windows Patches (I am not sure about it. I am guessing it). It is good that you have certificate & your value shows "True" then you are good to go.

    I faced the issue on multiple machines where I didn't check value "False" & I did 4 steps which failed & I started receiving 1796 & 1801 error event in Windows SYSTEM Event Viewer.

    The fix is already provided by VMware in below KB article & it is helpful. 

    https://knowledge.broadcom.com/external/article?articleNumber=423893

    https://knowledge.broadcom.com/external/article/423919

    -------------------------------------------