2 Commits
Author SHA1 Message Date
Mounir IDRASSI 301496c7e2 Windows: make EFI trust checks dbx-aware
Reject revoked loader CA sets and diagnose the chainloaded Windows manager. Add PCA 2011 migration warnings and update Secure Boot guidance.
2026-07-13 22:54:49 +09:00
Mounir IDRASSI d773ce95e6 docs: add EFI Secure Boot page covering the 2023 CA transition
Document the two Microsoft-signed loader sets and their firmware db requirements, the EfiBootLoader diagnostics registry key, and the BIOS third-party certificates option needed on machines that ship with a 2023-only Secure Boot configuration.

Explain why the Windows Secure Boot certificate rollout does not trigger automatically on system-encrypted machines, how to trigger it via the documented AvailableUpdates registry value, the precautions to take, and the recovery procedures when Secure Boot blocks the boot chain.

Link the page from the System Encryption documentation and the CHM table of contents.
2026-07-07 17:49:34 +09:00