TBWinRE 4.10 UFD will not boot after installing 2023 secure boot certs

[OldNavyGuy]

TBWinRE 4.10 UFD will not boot after installing 2023 secure boot certs on Win 11 25H2 system.

Message is one of the files has an invalid signature.

Remade the UFD and still got the message

[OldNavyGuy]

Fixed it by doing the following (where E: is the drive letter for the UFD)...

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi E:\EFI\boot\bootx64.efi

[Brian K]

OldNavyGuy,

The default TBWinRE UFD boots in my computer with Secure Boot enabled. Why do we have a difference?

I have the 2023 Certificates in my BIOS.

[OldNavyGuy]

I revoked the old 2011 certs.

They will formally expire starting in June.

[Fracso]

I revoked the old 2011 certs.

They will formally expire starting in June.

And can you boot IFL? IFW in a WinPE?

[OldNavyGuy]

IFL boots from a UFD.

I don't use WinPE.

[OldNavyGuy]

Also, note that some bootable UFDs will need to be rebuilt, since the EFI partition may be read-only.

[Fracso]

IFL boots from a UFD.

I don't use WinPE.

Strange - my experience is different. If the MS UEFI CA 2011 certificate is disabled (equivalent to being revoked, I think), IFL 4.10 doesn´t boot.

[OldNavyGuy]

[Strange - my experience is different. If the MS UEFI CA 2011 certificate is disabled (equivalent to being revoked, I think), IFL 4.10 doesn´t boot.

Do a search for "garlin's PowerShell scripts for updating Secure Boot CA 2023" and "Ed Tittel Secure Boot Report Card Perfected"

[Brian K]

Strange - my experience is different. If the MS UEFI CA 2011 certificate is disabled (equivalent to being revoked, I think), IFL 4.10 doesn´t boot

Aren't you both saying the same thing? MS UEFI CA 2011 certificate is needed for IFL UFD to boot.