Secure Boot
Reference for the Secure Boot tab: audit the 2011-to-2023 UEFI CA certificate migration and stage the 2023 certificate across ISO, image, and live host.
The Secure Boot tab audits and fixes the 2011-to-2023 UEFI certificate migration (CVE-2023-24932) across a source ISO, a mounted image, and the live host - it reports where each stands, then lets you stage the 2023 certificate so deployments avoid the boot manager security validation error. This page documents every control and readout on the tab and its dialog. For the background, the per-version support table, and the fix walkthrough, see the Secure Boot 2023 Migration guide.
Where It Lives
Open it from the Updates page, Secure Boot tab. The tab works on whatever target is loaded - a mounted offline image, or this PC's live Windows. A separate read-only Secure Boot - Readiness dialog appears when you want the host verdict while a different image is loaded (covered at the end).
Reading the Tab
The tab is a two-column grid - Name (the finding or control) and State (its status word) - under up to two banded sections:
- Image - the offline image being edited (the band suffix shows the source path)
- Host - this PC's live firmware readout (the band suffix shows the motherboard model)
A Summary card above the grid carries the plain-language verdict and any advisory. Each band groups its Staging controls (what you queue) above the readouts (what the tab found). The Refresh ribbon button re-runs the audit on demand - a migration already running on this PC keeps the readouts current by itself (see Live Monitoring below). Reset reverts every queued Secure Boot setting to the image or live baseline.
Staging: What You Can Queue
Update boot manager
A checkbox under the Boot Manager group. It queues replacing the image's 2011-signed boot manager with the 2023-signed one. It is disabled when the image carries no 2023 boot-manager source. The result row previews the signer the boot manager will have after Apply, named with its own Secure Version Number (2023 Windows SVN 3), and carries Pending once ticked or Expiring while it stays 2011 - with the full certificate name and version on hover. The toggle's hover carries the compatibility caveat: with Secure Boot on, updated media boots only machines that already trust the 2023 certificate.
An image that is already 2023 is not automatically finished. The same checkbox comes back offered, unticked, in two cases: the image carries a newer 2023 boot set than the one deployed, in which case the row reads Update available; or a cumulative update is queued that may carry one, which cannot be confirmed until that update is integrated. Re-laying a 2023 boot manager over a 2023 one is same-certificate work, so it carries none of the firmware risk the 2011-to-2023 migration does, and ticking it costs nothing when the newer set turns out not to be there. Only when there is genuinely nothing newer does the row go quiet - dimmed, Boot manager already updated, no checkbox.
Deploy the 2023 certificate
A checkbox tree. The parent stages the certificate db-add; the children add the optional, irreversible hardening steps and gate on the parent.
| Control | What it stages | Reversible? |
|---|---|---|
| Deploy certificate: 2023 | Stages the 2023 certificate for deployment on first boot; the existing 2011 boot manager keeps working. | Yes, until applied |
| Revoke 2011 | Adds the 2011 boot-manager certificate to the firmware dbx. 2011-signed boot managers and media can no longer boot on a host this is fully deployed to. | Irreversible |
| Anti-rollback | Raises the boot manager minimum Security Version Number so firmware refuses older boot managers. | Irreversible |
| Skip device check | Forces the update past the firmware applicability check (the Arm64/Qualcomm known-issue hold). Set only when you know the firmware is fixed. | n/a |
Revoke 2011 and Anti-rollback are irreversible once applied to firmware. Revoking the 2011 certificate stops media still signed only by it from booting; the anti-rollback increment makes firmware refuse lower-SVN boot managers, so you must update all bootable media for the machine first or older recovery and install drives stop booting. NTLite confirms each before staging it.
The same intent is also exposed as a single choice on the Create ISO Secure Boot option (the combined values NTLite can stage):
| Choice | Meaning |
|---|---|
| Not staged | No certificate update staged (clearing cancels a revertible staged value). |
| Deploy certificate: 2023 | Deploy the 2023 certificates (reversible). |
| Deploy certificate: 2023 - Revoke 2011 | Deploy, plus revoke the 2011 certificate in dbx. |
| Deploy certificate: 2023 - Anti-rollback | Deploy, plus the SVN anti-rollback increment. |
| Deploy certificate: 2023 - Revoke 2011 - Anti-rollback | Full hardening: deploy, revoke, and anti-rollback. |
Automatic-deployment flags
These toggles steer how Windows auto-deploys the certificates after install:
| Toggle | What it does |
|---|---|
| Block automatic certificate deployment | Windows Update will not auto-deploy the 2023 certificates. |
| Opt in to the Microsoft-managed certificate rollout | Microsoft schedules the deployment via its controlled rollout (requires telemetry; not applicable to Server). |
| Skip device check | Forces the certificate update to proceed on firmware the applicability check would otherwise hold back - set only when you know the firmware is fixed. |
Host-only actions
When this PC is the loaded target, one extra repair action appears: Repair the Secure Boot update task. It recreates or re-enables the Windows Secure Boot update task so a staged migration can continue - a disabled or deleted task stalls the migration for good. It repairs the task; it does not run it, and the deployment still applies over later restarts. The row shows up only while there is something to repair: an unhealthy task and a migration still in flight. A healthy task, or a finished migration, offers nothing here.
The automatic-deployment flags follow the same rule from the other direction. Once the migration has completed they steer a rollout that already happened, so they render disabled, still showing their live values, rather than as live toggles.
Alternate boot loader
Under the Host band's Boot Manager row sits an Alternate row - the UEFI fallback loader at \EFI\Boot, the one firmware uses when it finds no other boot entry. Its value is a drop-down naming whoever occupies that slot right now, and picking a different entry queues a change to it. Unlike the certificate staging above, every choice here is a plain file operation and can be undone:
| Choice | What it does |
|---|---|
| The current occupant, by name | Leave the slot as found. This is the default, and its label is the readout - "2023 Windows SVN 3", "Recovery SVN 2", or None when the slot is empty. |
| Recovery / Upgrade / Overwrite | Put the Secure Boot recovery loader in the slot, so the 2023 certificate reapplies by itself if firmware Secure Boot settings are later reset. The verb states what it is doing to the current occupant: a bare name for an empty slot, Upgrade over an older loader, Overwrite over anything else. Not offered when that exact loader is already there. |
| Restore | Put back the loader that was displaced, named so you can see what returns. Offered only when there is one to put back. |
| Remove | Empty the slot. Offered only while the fallback is dormant. |
A queued choice is shown in bold and a Current: line appears beneath it, so you can read what is there against what you picked. The row hover gives the occupant's full certificate name and version.
When firmware lists no separate Windows boot entry, this fallback is the PC's active boot path, and changing it swaps or deletes the file the machine actually boots from. NTLite detects that case, withholds Remove entirely, and confirms before queuing anything else.
Servicing-task buttons
Inline word-buttons on the servicing-task row act on the Windows Secure-Boot-Update task directly:
- Run - fires the task now to advance the next staged step instead of waiting on the schedule
- Disable - halts the migration on this host (confirmed first)
- Enable - re-enables a disabled task
- Remove / Undo - queue or un-queue removal of the in-image servicing task
Readouts: What the Tab Reports
Allowed and Revoked Signatures
Two lists per band. Allowed Signatures are the certificates the firmware will trust to boot; Revoked Signatures are the ones it refuses (dbx). Each entry shows a short token (2023 Windows, 2011 Windows, 2011 Third-party, 2023 Option ROM) with the full certificate name and any expiry on hover - the 2011 Windows certificate expires October 2026, the 2011 third-party UEFI CA June 2026.
Boot Manager and KEK
Boot Manager reports which certificate authority the running or in-image boot manager is signed by (2023 Windows vs 2011 Windows), with the full name on hover. On the host, a separate Boot Manager (ESP) reads the actual signer on the EFI System Partition and flags it when it disagrees with the migration state Windows reports. The Key Exchange Key (KEK) row shows whether the 2023 KEK is present - without it, firmware cannot receive 2023-signed certificate updates.
Secure Version Numbers
Boot managers carry a Secure Version Number, and firmware can be told to refuse anything below a floor. Both halves are readable on the tab. The Host and Image boot-manager rows name their loader with its own SVN inline (2023 Windows SVN 3), blank when the loader carries none rather than showing a made-up zero. On the host, an Anti-rollback floor (SVN) row sits under Boot Manager with the floor this firmware currently enforces; it stays hidden until an anti-rollback or revocation wave has actually set one, which on most machines means it is simply not there.
The two are read against each other. When the loaded image's boot manager would land below this PC's floor, the Image band raises an amber advisory naming both numbers: the image will not boot here under Secure Boot, though it still boots a machine whose floor is at or below it - the ordinary case when building media for a different PC. It is a warning, not a block, and the Apply page repeats it.
Audit Mode and BitLocker
Two host readouts change what the rest of the band means.
Audit Mode appears only when firmware is in it, and it is a warning: Secure Boot is on and checking signatures, but not enforcing them - failures are logged rather than blocked, so the plain On above it overstates the protection in place. Rare outside OEM and provisioning machines. The Summary repeats it, because it holds true in any migration state.
BitLocker reports whether this PC's OS volume is protected, and names the protector on hover. It is an informational row - BitLocker being on is normal - but it has a consequence here: updating Secure Boot certificates changes the firmware measurement, so Windows asks for the BitLocker recovery key on the next boot. NTLite raises that warning when you pick a certificate change, not when you apply it, so you can have the key to hand or suspend BitLocker first. It is deliberately not suppressible, and the command line shows it too.
Servicing task, Events, and Migration progress
Servicing task shows whether the Secure-Boot-Update task is Enabled, Disabled, or Missing, with its last run and result. Events (TPM-WMI) is a collapsible timeline of the firmware deployment events (cert added, dbx revoked, handoff error, reboot pending, complete). Certificate migration reports the steps remaining and the step currently processing; a disabled or missing task is called out because it stalls the migration.
Live Monitoring
While a migration is actually in flight on this PC, these readouts are not a snapshot waiting on Refresh - the tab watches and updates itself as the migration advances, with no button to press and no setting to turn on. The Events group carries a moving marker while the newest event is something other than a clean result, so the tab shows at a glance that work is still happening.
The watching is deliberately narrow. It runs only while there is a migration to track and only while you are looking at this tab, and it stops on its own once the migration finishes or you leave. It also stands aside rather than redrawing under you: a tick is skipped while a confirmation is open or a drop-down is in use.
Run on the servicing-task row greys out after a click and comes back once the migration state moves, so a fired task reads as fired rather than inviting a second click. A host that is idle or blocked in firmware never moves that state, so the button re-enables on its own after a short wait instead of staying stuck.
Virtual machine
When Windows runs inside a virtual machine, the Host band adds a Virtual machine row naming the platform (VirtualBox, VMware, Hyper-V, KVM, QEMU, Xen, Parallels) - everything the band reads is the guest's virtual firmware certificate store, not the physical PC's. A physical PC that merely has the Hyper-V role installed is not flagged.
Staging progression states
When a value is already staged, the tab describes exactly where it is:
| The tab shows | Meaning |
|---|---|
| No certificate update staged. | Nothing queued. |
| All 2023 certificates staged for deployment; applies on next boots. | Deploy queued, no revocation. |
| All 2023 certificates staged with PCA 2011 dbx revocation; applies on next boots. (Irreversible) | Deploy plus 2011 revocation. |
| All 2023 certificates staged with the SVN anti-rollback increment; applies on next boots. | Deploy plus anti-rollback. |
| Certificate deployment partially applied; remaining steps are queued and apply over future boots, paced by Microsoft’s staged rollout. | In progress across boots. |
| Certificate deployment complete (0x4000); all deployable bits cleared. | Done. |
Summary Advisories
The Summary card states one verdict for the loaded target. The common image and host advisories:
| Situation | Advisory | Severity |
|---|---|---|
| Version predates the updates | This Windows version predates the Secure Boot certificate updates, so it cannot deploy the 2023 certificates yet. Integrate the latest cumulative update. | Warning |
| Branch out of servicing | This Windows version does not receive the 2023 Secure Boot certificate update support. The 2023-signed boot manager can still be applied. | Warning |
| Image ready | This image is ready for 2023 Secure Boot. No action needed. | OK |
| Deploy staged | 2023 Secure Boot certificate deployment is staged - it applies on the next restart. | Info |
| Host: setup mode | Setup Mode - Secure Boot is not enforcing. | Warning |
| Host: audit mode | Audit Mode - Secure Boot is not enforcing: signature failures are logged, not blocked. | Warning |
| Host: 2011 only | Apply the certificate update before the 2011 certificates expire (June/October 2026), or this PC may stop booting updated media. | Warning |
| Host: lockout risk | No boot signer is trusted: the 2011 certificate is revoked and the 2023 certificate is not trusted, which can prevent this PC from booting. | Critical |
| Host: migrated | Secure Boot is fully migrated to the 2023 certificates. No action needed. | OK |
| Host: virtual machine | Runs in a virtual machine: this shows the VM’s own virtual firmware certificate store, not the physical PC’s. Certificate updates apply inside the guest as on a physical machine when the virtual firmware supports them; older VM firmware may need a virtualization-platform update first. | Info |
| Host: Secure Boot off | Secure Boot: Off - Secure Boot is not enforcing. The certificate state applies once Secure Boot is enabled. | Info |
State words follow a fixed severity scale: OK, Info, Warning, Critical. Only Warning and Critical findings render as inline rows; the rest fold into the readout and the Summary card.
The Host Readiness Dialog
When this PC is not the loaded target, NTLite can show a read-only Secure Boot - Readiness dialog: the same host readout and Summary as the tab's Host band, with no staging controls. It is read-only, not frozen - like the tab, it follows a migration that is in flight rather than needing to be reopened. It carries a More info link (Open: Updates - Secure Boot) that closes the dialog and loads this PC's Windows so you can act on the findings, plus the same Run / Enable / Disable servicing-task buttons. To stage changes, load the live C:\Windows as the target on the Image page.
The Create ISO / Export Secure Boot Group
The Create ISO dialog (and Export, when an ISO is queued) shows its own Secure Boot section whenever the source media is UEFI-bootable. It decides what the built media boots on - independent of the certificate staging on the Updates tab, and never written to the preset or the loaded image's settings (the choices are per-build; the last boot-sector pick is remembered as the dialog default).
Update boot manager (media)
Offered when the media's boot manager is 2011-signed and the loaded image carries a 2023 source (or, on already-2023 media, a newer 2023 build). Default off - forcing the 2023 boot manager onto media for machines whose firmware does not trust the 2023 certificate leaves them unable to boot it. Beneath the toggle, Boot manager rows report the media's current signer and the available (Pending, once ticked) one, with the full certificate name, version, and Secure Version Number on hover.
Boot Sector
A drop-down picking the disc's El Torito boot record - the gate for booting the disc optically, an independent lever from the boot manager above:
| Choice | Description shown |
|---|---|
| Automatic | The default. Follows whichever generation the boot manager on the built disc ends up on, and shows that resolved generation dimmed beside the choice. |
| 2011 (expiring) | Boots most machines today but its certificate expires in 2026. |
| 2023 | With Secure Boot on, boots only machines that already trust the 2023 certificate. |
The 2023 choice unlocks only when the built disc's boot manager will be 2023 (already 2023, or its update toggled) - picking it auto-enables the boot-manager update, and unticking the update reverts the sector to 2011, so the disc never ships the incoherent half (2023 sector over a 2011 boot manager).
Advisories
- Picking the 2023 boot sector adds a note that machines without the 2023 certificate cannot boot the disc; the Apply page repeats it in red with a clickable Secure Boot - Host Readiness link when this PC is not yet migrated
- If the media's boot manager Secure Version Number sits below this PC's firmware anti-rollback floor, a warning states the disc will not boot here under Secure Boot (it still boots machines whose floor is at or below that version)
For which generation fits which fleet - including mixed hardware and virtual machines - see the migration guide.
Related
Secure Boot 2023 Migration guide - the boot manager validation error explained, the per-version support table, and the step-by-step fix. Updates - the page that hosts this tab.