Outdated SecureBoot keys on Asus motherboards !!!

[Wesley1]

I'm getting this warning on Windows 11 25h2 v10.0.26200.6899

Secure Boot CA/keys need to be updated. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:ASUSTeK COMPUTER INC.;FirmwareManufacturer:American Megatrends Inc.;FirmwareVersion:3001;OEMModelBaseBoard:ROG STRIX Z790-F GAMING WIFI;OEMManufacturerName:ASUS;OSArchitecture:amd64;

This is consistent with Microsoft announcement, PLEASE UPDATE, along with Intel ME firmware v16.1.38.2676.

SecureBoot Keys about to EXPIRE in few months.

[inge70]

There's already a thread on this topic 🙂

Because the current Windows 11 update also causes a TPM-WMI error to appear in the event log.

We should agree on one thread, otherwise there will be endless threads again. 😉

[Wesley1]

I'm reporting the issue here, your thread is about hiding the problem. The keys in BIOS need to be updated.

[inge70]

My thread is NOT about hiding the error, but rather about fixing it by manually updating the SercueBoot certificates, thus avoiding having to wait for MS and Asus to respond.
In the meantime, @MoKiChU has posted instructions to FIX the error message.

My thread is NOT about hiding the error, but rather about fixing it by manually updating the SercueBoot certificates, thus avoiding having to wait for MS and Asus to respond.
Following @MoKiChU's instructions, the error is fixed, and then only a message, TPM-WMI ID 1808, is displayed, indicating that the SecureBoot certificates have been successfully updated. This message then appears every time the PC/laptop boots.
Nothing is hidden; it's fixed.

[JohnAb]

Wesley won't use anything by MoKiChU, basically says he's a BIOS modder posting random stuff on the internet. Strange but true. Just ignore him as he's rude and ungrateful for any help. I'll call out his behaviour as I have no time for rudeness.   

[PauloPanda]

My ROG STRIX Z690-E Gaming WIFI encountered the same problem. Used the solution provided by MokiChu and all is okay now. Just need to restart the PC a few times.

[Wesley1]

Hope Assus will release BIOS update for z790 board soon, no point waiting for May/June 2026.

CA root keys can be issued for many years timeframe.

[drminer]

I have the Z790 Hero motherboard. I ran the script from Github that checks both current and default KEK and DB. It showed 2023 certificates were already installed in the default keys. I am using the 3001 version of the UEFI. So, you might already have the newer certificates in your default KEK and DB.