Event details
Hello.
I have some pcs Windows 11 and some Windows servers that show the CA2023 is "true" with this command (
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
), and show the KEK certificate is "true" with this command (
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI KEK).bytes) -match 'Microsoft Corporation KEK 2K CA 2023')
), but with this query (certutil -dump PK.der) show 00 that means they don't have the Platform key (PK) certificate present in the VM, in this scenario do I need to update the PK or is enough to have the CA2023 present and the KEK certificate present too in this VMs?
Thanks.
You do not need a PK installed if Secure Boot is working fine without (depending on firmware) and you have all the required KEKs in the KEK store. The PK is only needed to update PK or KEK stores.