08-25-2024, 08:35 AM
(This post was last modified: 08-25-2024, 02:45 PM by Van Flusen.)
I have been booting the ISO's with Ventoy and Secure Boot enabled on an old DELL PC (officially not suitable for Windows 11) for the last few days and yesterday
Windows automatically installed an update.
Ventoy no longer boots with Secure Boot enabled and the PC shuts down.
Ventoy is great and so easy to use in the standard configuration, but there will never be a permanent solution for Ventoy and other bootloaders not signed by MS.
It has nothing to do with Dell, I have other PC's (self-built pc) and Windows Update has also updated the dbx database on these PCs, so the Ventoy Secure Boot option no longer works.
Use Easy2Boot with partition image files (.imgPTN),
WinSetupFromUSB with restrictions (no Linux) or an
IODD (bootable virtual CD-ROM drive) and you will have no problems with Secure Boot enabled.
If you often have to boot other people's PCs, it is always an advantage to have several tools at your disposal.
Edit: longpanda wrote a long time ago about this topic
https://forums.ventoy.net/showthread.php?tid=2163
It should be that: The BIOS firmware trust BOOTX64.EFI (it's actually shim.efi) then BOOTX64.EFI trust grubx64.efi.
So the Ventoy .cer file is for BOOTX64.EFI to trust grubx64.efi not for the BIOS.
The BOOTX64.EFI was already signatured by Microsoft Key and should be trusted by the BIOS firmware by default.
If your BIOS report bad sig that means that your BIOS doesn't trust BOOTX64.EFI anymore.
It may because that Microsoft add the BOOTX64.EFI to the dbx and after you update Windows the dbx info will write to your motherboard and then when reboot
your BIOS find that the BOOTX64.EFI's hash is in the dbx so it refuse to boot it and report bad sig.
So what you need it to make your BIOS trust BOOTX64.EFI in some way.
Windows automatically installed an update.
Ventoy no longer boots with Secure Boot enabled and the PC shuts down.
Ventoy is great and so easy to use in the standard configuration, but there will never be a permanent solution for Ventoy and other bootloaders not signed by MS.
It has nothing to do with Dell, I have other PC's (self-built pc) and Windows Update has also updated the dbx database on these PCs, so the Ventoy Secure Boot option no longer works.
Use Easy2Boot with partition image files (.imgPTN),
WinSetupFromUSB with restrictions (no Linux) or an
IODD (bootable virtual CD-ROM drive) and you will have no problems with Secure Boot enabled.
If you often have to boot other people's PCs, it is always an advantage to have several tools at your disposal.
Edit: longpanda wrote a long time ago about this topic
https://forums.ventoy.net/showthread.php?tid=2163
It should be that: The BIOS firmware trust BOOTX64.EFI (it's actually shim.efi) then BOOTX64.EFI trust grubx64.efi.
So the Ventoy .cer file is for BOOTX64.EFI to trust grubx64.efi not for the BIOS.
The BOOTX64.EFI was already signatured by Microsoft Key and should be trusted by the BIOS firmware by default.
If your BIOS report bad sig that means that your BIOS doesn't trust BOOTX64.EFI anymore.
It may because that Microsoft add the BOOTX64.EFI to the dbx and after you update Windows the dbx info will write to your motherboard and then when reboot
your BIOS find that the BOOTX64.EFI's hash is in the dbx so it refuse to boot it and report bad sig.
So what you need it to make your BIOS trust BOOTX64.EFI in some way.