I'm trying to update a few older machines so they will support the Microsoft 2023 UEFI secure boot certificates. These machines include Optiplex 7040s and Precision 7530s, machines with a BIOS type that Dell calls "Type 2" according to this KB:

https://www.dell.com/support/kbdoc/en-us/000368610/

The Precision 7530, for instance, won't be getting any BIOS updates that include the new keys and certificates, but Windows can update them and store them in NVRAM on the machine. I can verify this using some Secure Boot tools from GitHub:

https://github.com/cjee21/Check-UEFISecureBootVariables

These tools will show the default stored certs and the current stored certs. With this I can make a Precision 7530 with an 8th gen Intel CPU boot using an updated Windows bootloader signed with the new certs.

However, if I ever need to BIOS reset one of these machines. I'd need to be able to replace the certs. BIOS Setup has a "Custom Mode" for managing Secure Boot keys, and I can save the four "variables" to disk files. I can actually export these without turning Custom Mode on. If I want to re-import them again, I would turn Custom Mode on and then "Replace from file" all four key files. But I can't.

Attempting to do so gives me a prompt: "Error replacing key: Please make sure that the new key is properly formatted with signature list and serialization headers."

I would have expected that files I just exported from the same machine would already be properly formatted. But the import process probably requires extra steps that I missed.

A cursory search on this only brought up documents on the upcoming June 2026 expiration of the existing Secure Boot certs, some general BIOS management instructions, and other nonsense, but no guide on how to construct key files that I can import using the BIOS "Custom Mode." It's also possible that the BIOS tool just doesn't work - Secure Boot was still fairly new and key management might not have been fully tested.

If I need to generate other files or if I need to use external tools like OpenSSL, I can do that. But I don't even know where to start.