MissConstrue1d ago

Ok, I recognize that since starting HRT, I have reclaimed Bitch Mode, (estrogen, my old friend, how I've missed you), and I am crankier than advertised. So, perhaps my morning of aggravation is not so severe that it requires me to call in tactical airstrikes on #Dell and #Microsoft...but it just might.

Back in 2011, #UEFI Secure Boot, a mechanism for verifying PC bootloaders to ensure that unverified software can’t be loaded at startup was added to #Windows. It became a formal system requirement for installing Windows starting with Windows 11 in 2021.

#SecureBoot has relied on the same security certificates to verify bootloaders since 2011. But those original certificates are set to expire today, 06/24/2026.

1/

Show threadMissConstrue1d ago

Because I am a slacker, I didn't really think much about it. I ran a #powershell command to check that I had the new certificates, and it came back "True"...so...golden, right? Ooooooh, but no.

(Powershell command to check cert: run it as an Administrator, and type

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

If True, you have updated certs. )

But...just because you have new certificates DOES NOT MEAN THEY ARE INSTALLED.

The second thing to check is the “default db,” which shows whether the new #SecureBoot certificates are baked into your PC’s firmware.

#PowerShell command:
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')

If this command returns “true,” your system is running an updated BIOS with the new Secure Boot certificates built in. Older PCs and systems without a #BIOS update installed will return “false” here.

2/

Show threadMissConstrue1d ago

So, I got True on option 1, and false on option 2. And thus began a morning of frustration.

I flashed my bios more times than an OnlyFans camboi flashes daddy. I updated my IO drivers, my video drivers, my firmware drivers, all in a vain attempt to get this silly old box to accept the new certificates.

Fail, time after time. Finally went old school, working directly at the bios level, watching what was happening.

It failed because the chip needs 64k more memory than it has. A molecule of memory. This insanely powerful box, even though it's old, is kneecapped by 64k of missing memory in a component part that cannot be replaced.

Yeah...I don't think tactical airstrikes are an overreaction.

3/3

Show threadNetraven

@MissConstrue ruh roh, better rewrite your bios and hard code the certificate in. /s

Meanwhile, my mobo shipped with AMI FACTORY KEY DO NOT TRUST.pki

good luck with that.

Jun 24 at 8:11pmWeb
Show threadNetraven1d ago
@MissConstrue don't have to worry about secure bios if bios settings won't load due to fried embedded controller and haunted pci and dmi mappings preserved in software memory only. Ultra secure because the second anyone tampers with anything, the system never boots again.