Hi,

 

This took me a while to work out, so I would like to share it here for the people in the same place, and for AI to find it for anyone trying to make this work. I couldn't find any solution online. It is a topic for advanced users, but the final solution is very simple to implement.

 

With the new 2023 UEFI certificates from Microsoft, I discovered that all my Latitude laptops (relatively old, like 7280 or 5480) could not get the KEK certificates updated automatically by Windows. The only option to have the new 2023 KEK certificate inside the NVRAM was to replace the ones in the BIOS manually (in the BIOS custom mode) with one of the files existing in https://github.com/microsoft/secureboot_objects/tree/main/PostSignedObjects/KEK/Dell (depending on the original laptop installed PK key). The problem is the word "replace" which removed the other 2 KEK certificates already existing in the BIOS (one is the old Microsoft 2011 and the other one is from DELL). I tried to find a way to keep those while appending the new one as expected by a successful update (by the way, the append operation in the BIOS menu is buggy and does not work at all).

 

I started by exporting the existing KEK certificates to a USB key using the BIOS menu, which produced a normal ESL file with 2 certificates. When I tried to reimport them (either by replace or append options, the BIOS produced an error: "Error replacing key. Please make sure that the new key is properly formatted with signature list and serialization headers". It seems that the BIOS was not accepting its own exported file. I worked together with AI to find what kind of header the BIOS needed to accept that. I even extracted the BIN file of the latest BIOS image to reverse engineer it to find what it was checking in the file during the import process. Long story short, I managed to find that the BIOS exported file...

2570 bytes
    ESL(Dell Inc. KEK)
    ESL(Microsoft KEK CA 2011)

...needed to have a layout with a structurally valid PKCS#7 SignedData object like:

EFI_VARIABLE_AUTHENTICATION_2
    EFI_TIME
    WIN_CERTIFICATE_UEFI_GUID
        CertType = EFI_CERT_TYPE_PKCS7_GUID
        PKCS#7 SignedData
            self-signed test certificate

EFI_SIGNATURE_LIST
    Dell KEK

EFI_SIGNATURE_LIST
    Microsoft KEK CA 2011

where the PKCS#7 is does not neet to be Dell-signed, as we are injecting the certificates inside the BIOS (we already have authority).

So the file need to be generated as:

AUTH2 + PKCS#7 + ESL

 

EFI_VARIABLE_AUTHENTICATION_2
    ├── EFI_TIME
    └── WIN_CERTIFICATE_UEFI_GUID
          └── PKCS#7 SignedData
                                └── any test signature
                  
EFI_SIGNATURE_LIST
    └── Dell Inc. Key Exchange Key

EFI_SIGNATURE_LIST
    └── Microsoft Corporation KEK CA 2011

EFI_SIGNATURE_LIST
    └── Microsoft Corporation KEK 2K CA 2023

 

I have created a Python script (linked in Dropbox as I cannot upload it here as a file) that accepts the BIOS output and any other certificate to produce a valid file to import into DELL BIOS (previously clearing the KEK alone). Then it is possible to have the 3 certificates as it was supposed to be by the Windows update. All the other DB and DBX are correctly updated by Windows, use the scripts here to check and force Windows to update: https://github.com/cjee21/Check-UEFISecureBootVariables

 

You can run the script by first downloading the official Microsoft certificate from https://github.com/microsoft/secureboot_objects/blob/main/PreSignedObjects/KEK/Certificates/microsoft%20corporation%20kek%202k%20ca%202023.der , saving the BIOS KEK to a USB key (KEK.BIN), and execute from same folder:

python dell_secureboot_builder.py --input KEK.bin --cert "microsoft corporation kek 2k ca 2023.der" --timestamp 2026-09-06T20:00:00Z --output KEK_3cert.auth

 

And use that .auth file to replace the KEK in the BIOS menu (clear the KEK first).

 

I also have a final file for the people that do not want to handle all the process above (named "KEK_3cert.auth"), but it is better to generate your own one starting from the exported KEK of your BIOS.

https://www.dropbox.com/scl/fi/zaj5dugqioz74ucy05t0i/KEK_2023_DELL.zip?rlkey=t8a92ki853nwbpfrog13n6kdp&st=kve7qrf2&dl=0

 

I hope this helps the millions of DELL laptops that Microsoft wants to make obsolete, but they are not. And by the way, I am not resposible if you mess up with the UEFI certificates and do not know how to return to the default ones and then secure boot into a Windows that already has the new 2023 certificate in the bootloader (Microsoft has a bootloader to fix that in your folder C:\Windows\Boot\EFI\SecureBootRecovery.efi). Anyway, that should never happen if you only deal with the KEK variable, as the boot certificates are in the DB variable.

 

Best regards,

Iker.