Administration - Hardware
      Back to home
      1. ggCircuit Help Center
      2. ggRock User Manual
      3. Administration - Hardware

      Secure Boot Configuration

      The purpose of this article is to provide a common method for installing both the Microsoft and ggCircuit Secure Boot certificates to UEFI keystores on a computer system.

      Flash Drive Preparation

      1. Download KeyTool.zip and extract it to the root of any flash drive.

        Name the drive something memorable such as "ggDrive" or "KEYTOOL" to make it easy to differentiate between the USB drive and any other drives installed in this PC.

       

      NOTE:

      Make sure the directory structure of the flash drive looks like the following after extracting the contents of KeyTool.zip to it.




      G:\>dir /S
       Volume in drive G is ggDrive
       Volume Serial Number is GGCI-RCUIT

       Directory of G:\

      08/20/2024  06:50 PM    <DIR>          EFI
      08/20/2024  06:42 PM             2,056 GG.auth
      08/20/2024  06:42 PM               781 GG.cer
      08/20/2024  06:42 PM             1,462 MicCorKEK2KCA2023.cer
      08/20/2024  06:42 PM             1,454 MicWinUEFICA2023.cer
      08/20/2024  06:42 PM             1,499 MS_CA_2011.cer
      08/20/2024  06:42 PM             1,516 MS_KEK_2011.cer
                     6 File(s)          8,768 bytes

       Directory of G:\EFI

      08/20/2024  06:50 PM    <DIR>          .
      08/20/2024  06:50 PM    <DIR>          ..
      08/20/2024  06:42 PM    <DIR>          BOOT
                     0 File(s)              0 bytes

       Directory of G:\EFI\BOOT

      08/20/2024  06:50 PM    <DIR>          .
      08/20/2024  06:50 PM    <DIR>          ..
      08/20/2024  06:42 PM           136,192 BOOTX64.efi
                     1 File(s)        136,192 bytes

           Total Files Listed:
                     7 File(s)        144,960 bytes
                     6 Dir(s)  1,435,224,072,192 bytes free

      G:\>

      Certificate Installation

      1. Plug the flash drive into a computer and access the computer's BIOS setup menu by pressing <F2>, <Del>, or <ESC> according to the manufacturer's instructions.
      2. Put the platform in setup mode (this can be accomplished by deleting the "Platform Key (PK)", or by clearing secure boot keys.)
      3. Boot your PC from the flash drive containing KeyTool.efi which permits adding the keys to your BIOS.  Typically this involves pressing <F8> to access to the boot menu.
      4. When KeyTool loads, choose the second menu item “Edit Keys”.

      5. Key Exchange Key Database (KEK)


        1. Choose "The Key Exchange Key Database (KEK)".
        2. Select "Add New Key".
        3. Navigate to and select the file “GG.cer”.
        4. Repeat the process for the files “MicCorKEK2KCA2023.cer ” and “MS_KEK_2011.cer”.

      6. Allowed Signatures Database (db)

        1. Select "The Allowed Signatures Database (db)".


        2. Select "Add New Key".


          Navigate to and select the file “MicWinUEFICA2023.cer ”.


          Repeat the process for the files “MS_CA_2011.cer ” and “GG.cer”.

      2. Platform Key (PK)


        1. Select "The Platform Key (PK)".
        1. Choose "Replace Key(s)".
        2. Navigate to and select the file “GG.auth”.

      Final BIOS Configuration

      1. Press <CTRL> + <ALT> + <DEL> to reboot the computer.
      2. Unplug the USB drive.
      3. Boot into BIOS (usually by pressing <F10>, <ESC>, or <DEL> during startup).
      4. In BIOS, navigate to "Boot Options".
      5. Enable "Secure Boot" (some manufacturers may refer to this as "Windows UEFI Mode").

      NOTE:

      In some cases, setting the PK value will automatically enable secure boot, on other platforms this step must be manually performed as outlined above.

      6. Save the changes and exit the BIOS setup menu.



       

      NOTE:

      If you boot to Windows and run msinfo32.exe, you should see the BIOS mode is “UEFI” and the Secure Boot State is “On”.

       

      You may also confirm Secure Boot status by utilizing the "Confirm-SecureBootUEFI" powershell cmdlet.  If this cmdlet returns "true" then secure boot is enabled.