Framework 13, Gen 11: BIOS 3.24 installed, missing 2023 files for Secure Boot keys?

[Chris_Tromley]

Just learned of the expiring keys for Secure Boot and that I need a BIOS upgrade. Note that I am NOT a power user. Found and installed the upgrade, checked that my driver bundle is in fact current. Windows Security still says Secure Boot cannot be enabled.

QUESTION 1: If all is well and ready, do I need t wait for the next Win11 update for the new files to be recognized before Secure Boot is enabled?

After the update, there are no updated KEK files. Only two entries:

KEK Signature List:

1. [PKCS7] Microsoft Corporation KEK CA 2011
2. [PKCS7] frame.work-LaptopKEK

Also post-update, the following shows up on the DB page:

DB Signature List:

1. [PKCS7] Microsoft Windows Production PCA 2011
2. [PKCS7] Microsoft Corporation UEFI CA 2011
3. [PKCS7] frame.work-LaptopDB
4. [PKCS7] Windows UEFI CA 2023
5. [PKCS7] Microsoft Option ROM UEFI CA 2023
6. [PKCS7] Microsoft UEFI CA 2023

QUESTION 2: Do these files look correct, or is there something missing (like a 2023 KEK file or files)?

QUESTION 3: If all is not well, how do I go about correcting it?

[Rupert_Woods]

Framework Laptop 13 - 11th Gen Intel Core BIOS 3.24 Release STABLE

Update: I took the following steps, and I no longer have the reported issue. Used the “Fix problems with Windows Update” option in Windows Settings * Issue remained Performed “Reset this PC”, keeping personal files * Issue remained Created a Windows Media Installation and performed a fresh install of Windows 11 Pro * Issue remained Removed all secure boot certificates in the BIOS using the “Erase all Secure Boot Settings” option in the BIOS * All certificates were removed, no issues booti…

[Sergio_Ortega]

Before erasing Secure Boot settings, I’d make sure BitLocker/recovery key is saved somewhere offline. If Secure Boot is currently off and Windows Security still complains after BIOS 3.24, I would compare against the official 3.24 release thread and only then reset keys in BIOS. The DB entries you list include the 2023 Microsoft CAs, so I would not expect a separate “2023 KEK” entry to be the main missing piece.

[Graham_Lane]

I am fighting this but now can boot with secure boot again after downgrading to 3.22 clearvar, upgrading to 3.23, then 3.24. I have kek database options that include 2023, but the KEK section only has 2011. Getting the microsoft error about my system will not automatically upgrade secure boot, still. Tried forcing the cert files into a place where I could manually add them but they dont show up named ,der or .crt. so I can’t seem to make the bios move add them manually. is this just a wait and hope MS fixes this?