Secure Boot playbook for certificates expiring in 2026

Hi RayC15:   at vms which are newley created in Version ESXi 8.0.2  Microsoft can make all Updates because they have already the 2023 Certs and with registry we could Update the VM  and Status Uefi is completed. 

We testes it on one customer which have unfortunately still  esxi7   we could added  the KEK and PK like this a 

A) ESXi 7.x to < 8.0 – Manual Update via UEFI Menu (Auth Bypass)

This method uses the UEFI Setup Screen and allows enrolling PK/KEK files directly from the firmware. It’s ideal when using Set-SecureBootUEFI inside the guest OS is not possible.

Step A1 – Prepare FAT32 Disk for PK/KEK

• Create an additional virtual disk (e.g., 64 MB) and attach it to the target VM.
• Format the disk as FAT32 and label it (e.g., UEFIKEYS).
• Copy the required PK and KEK files to this disk, for example:
  • PK\WindowsOEMDevicesPK.der
  • KEK\microsoft corporation kek 2k ca 2023.der

Step A2 – Configure vSphere for Auth Bypass and Setup Mode

• Power off the VM.
• In VM Options → Advanced → Edit Configuration, add: uefi.allowAuthBypass = "TRUE"
• In VM Options → Boot Options, enable Force BIOS/UEFI Setup.
• Power on the VM. It will boot into the UEFI firmware setup screen.

Step A3 – Enroll PK and KEK in UEFI Setup

• Navigate to Secure Boot Configuration in the UEFI menu.
• Under PK Options, select Enroll PK and choose the PK file from the FAT32 disk. Confirm and save.
• (Optional) Under KEK Options, select Enroll/Append KEK and choose the KEK file.
• Exit the setup and shut down the VM.

Step A4 – Remove Auth Bypass

• In VM Options → Advanced → Edit Configuration, remove the entry: uefi.allowAuthBypass = "TRUE"

Step A5 – Validate in Windows

• Boot the VM and check that the Secure Boot certificates (PK and KEK) are correctly enrolled.
• Ensure the output shows the current certificates with valid issuer and expiration details.

But Windows cannot change all parameter think problem is there the KEK.

With mountvol S: /S  we see under S:\EFI\Microsoft\Boot  bootmgfw.efi  the 2023 cert but under   S:\Efi\Boot bootx64.efi we see the old PCA2011.  In registry UEFICA2023Staus is in Progress but will not finished.    eventlog: Secure Boot certificates have been updated but are not yet applied to the device firmware. Review the published guidance to complete the update and ensure full protection. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:Intel Corporation;FirmwareManufacturer:VMware, Inc.;FirmwareVersion:OEMModelNumber:VMware7,1;OEMModelBaseBoard:440BX Desktop Reference Platform;OEMModelSystemFamily:;OEMManufacturerName:VMware, Inc.;OEMModelSKU:;OSArchitecture:amd64;
BucketId: 780863cf2dd4d4a9144cd3e14efeda4c02b8542acf606ed4b2eba0d7215edd56

Dont know if this is a Problem that esxi7 is EOL and KEK cannot be updated.   Next try will be at other cusomters where VMs are created longer which have old Certs but ESXi host is already on 8.0.3.   Hope there it will work.    There was a new Link from Broadcom from 02.01.2026  https://knowledge.broadcom.com/external/article/423919/manual-update-of-secure-boot-variables-i.html      I would be interested to know how other administrators do this in a VMWARE ESXi environment. 🙃  BR Johannes