On Mon Feb 23, 2026 at 4:25 PM CET, Fiona Ebner wrote:
> Changes in v4:
> * Also enroll MS 2023 KEK.
> * Add ms-cert=2023k marker.
> * Clarify that there are multiple certificates in all descriptions.
> * Print correct marker when applying pending changes.
> * Mention that ms-cert=2023 and ms-cert=2023w may indicate partial
> enrollment in docs.
Tested this series with some Windows VMs and Proxmox VE VMs again:
- `qm enroll-efi-keys $vmid` and "Enroll updated certificates" in the
web interface work as expected and both the CAs and KEK are there
after a shutdown+start cycle
- Enrollment for efidisks with previous ms-cert=2023w work as expected
as well
- ms-cert={2023,2023w,2023k} on efidisk trigger the enrollment correctly
- Also tested it with a BitLocker'd Windows drive this time with and
without disabling the BitLocker key protectors beforehand
I tried to reproduce the 1801 event with any provided secure boot
updates from Microsoft Windows, but I couldn't trigger it on my VMs,
probably because I'm running an older Windows version on these VMs. Any
incoming updates were completed successfully, though none of them were
secure boot related.
The enrollment for the additional KEK 2K CA 2023 was tested with
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI KEK).Bytes)
-match 'Microsoft Corporation KEK 2K CA 2023'
and the equivalent for mokutil on a Linux VM:
mokutil --kek | grep 'Microsoft Corporation KEK 2K CA 2023'
Nothing seemed off to me here and the changes look good to me as well,
so consider this series as:
Reviewed-by: Daniel Kral <[email protected]>
Tested-by: Daniel Kral <[email protected]>
