I'm trying to update a few older machines so they will support the Microsoft 2023 UEFI secure boot certificates. These machines include Optiplex 7040s and Precision 7530s, machines with a BIOS type that Dell calls "Type 2" according to this KB:

https://www.dell.com/support/kbdoc/en-us/000368610/

The Precision 7530, for instance, won't be getting any BIOS updates that include the new keys and certificates, but Windows can update them and store them in NVRAM on the machine. I can verify this using some Secure Boot tools from GitHub:

https://github.com/cjee21/Check-UEFISecureBootVariables

These tools will show the default stored certs and the current stored certs. With this I can make a Precision 7530 with an 8th gen Intel CPU boot using an updated Windows bootloader signed with the new certs.

However, if I ever need to BIOS reset one of these machines. I'd need to be able to replace the certs. BIOS Setup has a "Custom Mode" for managing Secure Boot keys, and I can save the four "variables" to disk files. I can actually export these without turning Custom Mode on. If I want to re-import them again, I would turn Custom Mode on and then "Replace from file" all four key files. But I can't.

Attempting to do so gives me a prompt: "Error replacing key: Please make sure that the new key is properly formatted with signature list and serialization headers."

I would have expected that files I just exported from the same machine would already be properly formatted. But the import process probably requires extra steps that I missed.

A cursory search on this only brought up documents on the upcoming June 2026 expiration of the existing Secure Boot certs, some general BIOS management instructions, and other nonsense, but no guide on how to construct key files that I can import using the BIOS "Custom Mode." It's also possible that the BIOS tool just doesn't work - Secure Boot was still fairly new and key management might not have been fully tested.

If I need to generate other files or if I need to use external tools like OpenSSL, I can do that. But I don't even know where to start.

Pinned Posts

FAQ Optiplex Desktops

Please state model and chassis (DT, SFF, USFF) in the title

Industry-wide Issue with Intel Core 13th and 14th Generation i5, i7, and i9 Processors

Optiplex Desktops

Optiplex 780 install Windows XP issue

Optiplex 7060 Postboot RAM Error

Where to get a 24 to 6 pin adapter for optiplex mt 3070

Need help recovering BIOS password after successful ownership transfer – OptiPlex 7010

I forgot my dell password and need I help

Optiplex 3050 SFF ram problem

Intel Wireless-AC 9560 Driver Issue on Dell OptiPlex 7060 Micro (Windows 11 25H2)

Hard drive bay (not shipped if pc shipped with ssd only)

How to manage Secure Boot key files on "BIOS Type 2" machines?

Left-mouse button click not recognised (intermittent)

Optiplex 7410 AIO 35W as second screen/display/monitor

dell optiplex 7020 tower plus (2024) CPU upgrade from i7 14700 to i9 14900k

http://an error occurred when obtaining ip address:80/

Optiplex 9020 SFF fan full speed

Dell Optiplex 3070 Not Booting: 2 Amber, 5 White Light Blinks

Latest Solutions

Can i upgrade my dell optiplex 7010mt legacy edition

Fixed an issue with the Dell OptiPlex displaying no video from the onboard graphics after the driver installation.

FORGOT BIOS PASSWORD

Dell Optiplex 755 - Using last 17 years , still healthy

Trying to upgrade Dell Optiplex 3040 SFF RAM to 16GB, but keep getting errors

Dell Support Resources