Windows Secure Boot Certificate Remediation for Proxmox VE Windows VMs
This runbook documents a safe process for remediating the Windows Secure Boot certificate expiration / Microsoft UEFI 2011-to-2023 certificate transition for a Windows virtual machine running on Proxmox VE 9.2 or later.
Scope
Applies to Windows VMs running on Proxmox VE that use OVMF/UEFI firmware with Secure Boot enabled.
This process covers:
Important Concepts
1. Proxmox certificate enrollment updates the VM's virtual UEFI/OVMF Secure Boot certificate store.
2. This does not automatically guarantee that Windows has completed its own Secure Boot servicing process.
3. Windows may still need to deploy the 2023 Secure Boot certificates and install the PCA2023-signed boot manager.
4. If BitLocker is enabled, Secure Boot certificate/key changes can trigger BitLocker recovery because TPM measured-boot values may change.
5. In most cases, BitLocker should be suspended, not decrypted or permanently disabled.
Pre-Change Checklist
[ ] Confirm the VM uses UEFI/OVMF firmware.
[ ] Confirm Secure Boot is enabled for the VM.
[ ] Confirm the VM has an EFI disk.
[ ] Confirm the VM has a current backup.
[ ] Confirm the backup includes the VM's EFI disk.
[ ] Confirm the Windows BitLocker recovery key is documented and accessible.
[ ] Confirm you have administrative access inside Windows.
[ ] Confirm you have Proxmox administrative access.
[ ] Schedule a maintenance window.
[ ] Notify users/application owners as appropriate.
Step 1 - Check BitLocker Status
Start the Windows VM and log in.
Open PowerShell as Administrator and run:
manage-bde -status
Check whether drive C: or any other attached volumes are BitLocker protected.
To view protectors for C:, run:
manage-bde -protectors -get C:
If additional protected data drives exist, repeat the relevant commands for each protected drive.
Step 2 - Suspend BitLocker Protection
Do not decrypt the drive unless there is a separate operational reason to do so.
Suspend BitLocker protection on C::
manage-bde -protectors -disable C: -RebootCount 0
Alternative PowerShell cmdlet:
Suspend-BitLocker -MountPoint "C:" -RebootCount 0
Why use -RebootCount 0?
This prevents BitLocker protection from automatically resuming after a single reboot. That is useful because the Secure Boot servicing process may require more than one reboot.
If there are other BitLocker-protected volumes, suspend protection on those volumes as well.
Step 3 - Gracefully Shut Down the VM
From inside Windows, perform a normal shutdown.
Do not simply power off the VM unless Windows is hung or unavailable.
Step 4 - Enroll Updated Certificates in Proxmox
Use either the Proxmox GUI or the Proxmox CLI.
Option A - Proxmox Web GUI
1. In the Proxmox web interface, select the Windows VM.
2. Go to the Hardware tab.
3. Select the EFI Disk.
4. Click Disk Action.
5. Click Enroll Updated Certificates.
6. Confirm the action.
7. Start the VM after the enrollment completes.
Option B - Proxmox CLI
1. Make sure the VM is powered off.
2. Open the shell on the Proxmox node.
3. Run the following command, replacing <VMID> with the actual VM ID:
qm enroll-efi-keys <VMID>
Example:
qm enroll-efi-keys 104
4. Start the VM after the command completes.
Notes
- The Proxmox warning commonly references the marker ms-cert=2023k.
- If the VM is missing the 2023 Microsoft certificates, Proxmox may display a warning about outdated UEFI certificates.
- The CLI method requires the VM to be shut down.
Step 5 - Start Windows
Boot the Windows VM normally.
Expected result:
- Windows should boot normally.
- BitLocker should not prompt for a recovery key if protection was properly suspended.
- If BitLocker recovery still appears, use the documented recovery key.
Step 6 - Trigger or Verify Windows Secure Boot Servicing
The Proxmox certificate enrollment updates the VM firmware certificate store, but Windows still needs to complete its own Secure Boot update process.
Windows uses the Secure-Boot-Update scheduled task:
\Microsoft\Windows\PI\Secure-Boot-Update
For IT-managed or manual deployment, Microsoft documents using the AvailableUpdates registry value.
Open PowerShell as Administrator and run:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" `
-Name AvailableUpdates `
-Type DWord `
-Value 0x5944
Then run the scheduled task:
Start-ScheduledTask -TaskPath "\Microsoft\Windows\PI\" -TaskName "Secure-Boot-Update"
Reboot as required.
The Secure Boot servicing process may require more than one reboot.
Step 7 - Verify Windows Secure Boot Update Status
After Windows has rebooted, open PowerShell as Administrator and run:
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" `
-Name UEFICA2023Status,UEFICA2023Error,UEFICA2023ErrorEvent
Expected successful status:
UEFICA2023Status : Updated
Common status values:
- NotStarted
- InProgress
- Updated
If the status is InProgress, allow the servicing process to continue and reboot again if required.
If an error is shown, record:
- UEFICA2023Error
- UEFICA2023ErrorEvent
- Any related Windows Event Viewer entries
Step 8 - Re-Enable BitLocker Protection
After confirming that Windows boots normally and Secure Boot servicing is complete, re-enable BitLocker protection.
Command-line option:
manage-bde -protectors -enable C:
PowerShell option:
Resume-BitLocker -MountPoint "C:"
Verify status:
manage-bde -status
Confirm that protection is enabled again.
Step 9 - Final Validation
Perform the following checks:
[ ] Windows boots normally.
[ ] No BitLocker recovery prompt appears.
[ ] BitLocker protection is enabled again.
[ ] Secure Boot remains enabled.
[ ] Windows Secure Boot servicing status shows Updated, if applicable.
[ ] Applications/services start normally.
[ ] Event Viewer does not show new Secure Boot or BitLocker errors.
[ ] Backup system recognizes the VM normally after the change.
[ ] Change-control ticket is updated with results.
Rollback / Recovery Notes
If the VM fails to boot after certificate enrollment:
1. Do not repeatedly force power off the VM without capturing the error.
2. Record the exact boot error message.
3. Confirm whether the VM is using OVMF/UEFI and Secure Boot.
4. Confirm whether the EFI disk is present.
5. Confirm whether the correct VMID was used for CLI enrollment.
6. Attempt boot repair only after confirming a valid backup exists.
7. If BitLocker recovery appears, enter the documented recovery key.
8. If necessary, restore the VM from backup, including the EFI disk.
Change-Control Summary
Enroll updated Microsoft UEFI 2023 Secure Boot certificates for Windows VM running on Proxmox VE and verify Windows Secure Boot servicing status.
Risk:
Secure Boot certificate/key changes may alter TPM measured-boot values and trigger BitLocker recovery if BitLocker protection is not suspended first.
Mitigation:
- Confirm current VM backup.
- Confirm BitLocker recovery key.
- Suspend BitLocker protection before certificate enrollment.
- Enroll updated Proxmox EFI certificates while VM is powered down.
- Verify Windows Secure Boot servicing status.
- Resume BitLocker after successful validation.
Commands Summary
Check BitLocker:
manage-bde -status
manage-bde -protectors -get C:
Suspend BitLocker:
manage-bde -protectors -disable C: -RebootCount 0
Alternative:
Suspend-BitLocker -MountPoint "C:" -RebootCount 0
Enroll Proxmox EFI keys:
qm enroll-efi-keys <VMID>
Set Windows Secure Boot update registry value:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" `
-Name AvailableUpdates `
-Type DWord `
-Value 0x5944
Run Windows Secure Boot update task:
Start-ScheduledTask -TaskPath "\Microsoft\Windows\PI\" -TaskName "Secure-Boot-Update"
Verify Windows Secure Boot servicing:
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" `
-Name UEFICA2023Status,UEFICA2023Error,UEFICA2023ErrorEvent
Resume BitLocker:
manage-bde -protectors -enable C:
Alternative:
Resume-BitLocker -MountPoint "C:"
Source References
Proxmox forum - UEFI 2011 certificates expire in June 2026:
https://forum.proxmox.com/threads/uefi-2011-certificates-expire-in-june-2026.183799/
Proxmox VE 9.2 release announcement:
https://forum.proxmox.com/threads/proxmox-virtual-environment-9-2-available.183742/
Microsoft - Secure Boot troubleshooting guide:
https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d
Microsoft - Registry key updates for Secure Boot Windows devices with IT-managed updates:
https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d
Microsoft - manage-bde protectors command:
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors
This runbook documents a safe process for remediating the Windows Secure Boot certificate expiration / Microsoft UEFI 2011-to-2023 certificate transition for a Windows virtual machine running on Proxmox VE 9.2 or later.
Scope
Applies to Windows VMs running on Proxmox VE that use OVMF/UEFI firmware with Secure Boot enabled.
This process covers:
- Suspending BitLocker before Secure Boot key changes
- Enrolling the updated Microsoft UEFI 2023 certificates in the Proxmox VM EFI disk
- Triggering or verifying the Windows-side Secure Boot servicing process
- Verifying update status
- Re-enabling BitLocker protection
Important Concepts
1. Proxmox certificate enrollment updates the VM's virtual UEFI/OVMF Secure Boot certificate store.
2. This does not automatically guarantee that Windows has completed its own Secure Boot servicing process.
3. Windows may still need to deploy the 2023 Secure Boot certificates and install the PCA2023-signed boot manager.
4. If BitLocker is enabled, Secure Boot certificate/key changes can trigger BitLocker recovery because TPM measured-boot values may change.
5. In most cases, BitLocker should be suspended, not decrypted or permanently disabled.
Pre-Change Checklist
[ ] Confirm the VM uses UEFI/OVMF firmware.
[ ] Confirm Secure Boot is enabled for the VM.
[ ] Confirm the VM has an EFI disk.
[ ] Confirm the VM has a current backup.
[ ] Confirm the backup includes the VM's EFI disk.
[ ] Confirm the Windows BitLocker recovery key is documented and accessible.
[ ] Confirm you have administrative access inside Windows.
[ ] Confirm you have Proxmox administrative access.
[ ] Schedule a maintenance window.
[ ] Notify users/application owners as appropriate.
Step 1 - Check BitLocker Status
Start the Windows VM and log in.
Open PowerShell as Administrator and run:
manage-bde -status
Check whether drive C: or any other attached volumes are BitLocker protected.
To view protectors for C:, run:
manage-bde -protectors -get C:
If additional protected data drives exist, repeat the relevant commands for each protected drive.
Step 2 - Suspend BitLocker Protection
Do not decrypt the drive unless there is a separate operational reason to do so.
Suspend BitLocker protection on C::
manage-bde -protectors -disable C: -RebootCount 0
Alternative PowerShell cmdlet:
Suspend-BitLocker -MountPoint "C:" -RebootCount 0
Why use -RebootCount 0?
This prevents BitLocker protection from automatically resuming after a single reboot. That is useful because the Secure Boot servicing process may require more than one reboot.
If there are other BitLocker-protected volumes, suspend protection on those volumes as well.
Step 3 - Gracefully Shut Down the VM
From inside Windows, perform a normal shutdown.
Do not simply power off the VM unless Windows is hung or unavailable.
Step 4 - Enroll Updated Certificates in Proxmox
Use either the Proxmox GUI or the Proxmox CLI.
Option A - Proxmox Web GUI
1. In the Proxmox web interface, select the Windows VM.
2. Go to the Hardware tab.
3. Select the EFI Disk.
4. Click Disk Action.
5. Click Enroll Updated Certificates.
6. Confirm the action.
7. Start the VM after the enrollment completes.
Option B - Proxmox CLI
1. Make sure the VM is powered off.
2. Open the shell on the Proxmox node.
3. Run the following command, replacing <VMID> with the actual VM ID:
qm enroll-efi-keys <VMID>
Example:
qm enroll-efi-keys 104
4. Start the VM after the command completes.
Notes
- The Proxmox warning commonly references the marker ms-cert=2023k.
- If the VM is missing the 2023 Microsoft certificates, Proxmox may display a warning about outdated UEFI certificates.
- The CLI method requires the VM to be shut down.
Step 5 - Start Windows
Boot the Windows VM normally.
Expected result:
- Windows should boot normally.
- BitLocker should not prompt for a recovery key if protection was properly suspended.
- If BitLocker recovery still appears, use the documented recovery key.
Step 6 - Trigger or Verify Windows Secure Boot Servicing
The Proxmox certificate enrollment updates the VM firmware certificate store, but Windows still needs to complete its own Secure Boot update process.
Windows uses the Secure-Boot-Update scheduled task:
\Microsoft\Windows\PI\Secure-Boot-Update
For IT-managed or manual deployment, Microsoft documents using the AvailableUpdates registry value.
Open PowerShell as Administrator and run:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" `
-Name AvailableUpdates `
-Type DWord `
-Value 0x5944
Then run the scheduled task:
Start-ScheduledTask -TaskPath "\Microsoft\Windows\PI\" -TaskName "Secure-Boot-Update"
Reboot as required.
The Secure Boot servicing process may require more than one reboot.
Step 7 - Verify Windows Secure Boot Update Status
After Windows has rebooted, open PowerShell as Administrator and run:
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" `
-Name UEFICA2023Status,UEFICA2023Error,UEFICA2023ErrorEvent
Expected successful status:
UEFICA2023Status : Updated
Common status values:
- NotStarted
- InProgress
- Updated
If the status is InProgress, allow the servicing process to continue and reboot again if required.
If an error is shown, record:
- UEFICA2023Error
- UEFICA2023ErrorEvent
- Any related Windows Event Viewer entries
Step 8 - Re-Enable BitLocker Protection
After confirming that Windows boots normally and Secure Boot servicing is complete, re-enable BitLocker protection.
Command-line option:
manage-bde -protectors -enable C:
PowerShell option:
Resume-BitLocker -MountPoint "C:"
Verify status:
manage-bde -status
Confirm that protection is enabled again.
Step 9 - Final Validation
Perform the following checks:
[ ] Windows boots normally.
[ ] No BitLocker recovery prompt appears.
[ ] BitLocker protection is enabled again.
[ ] Secure Boot remains enabled.
[ ] Windows Secure Boot servicing status shows Updated, if applicable.
[ ] Applications/services start normally.
[ ] Event Viewer does not show new Secure Boot or BitLocker errors.
[ ] Backup system recognizes the VM normally after the change.
[ ] Change-control ticket is updated with results.
Rollback / Recovery Notes
If the VM fails to boot after certificate enrollment:
1. Do not repeatedly force power off the VM without capturing the error.
2. Record the exact boot error message.
3. Confirm whether the VM is using OVMF/UEFI and Secure Boot.
4. Confirm whether the EFI disk is present.
5. Confirm whether the correct VMID was used for CLI enrollment.
6. Attempt boot repair only after confirming a valid backup exists.
7. If BitLocker recovery appears, enter the documented recovery key.
8. If necessary, restore the VM from backup, including the EFI disk.
Change-Control Summary
Enroll updated Microsoft UEFI 2023 Secure Boot certificates for Windows VM running on Proxmox VE and verify Windows Secure Boot servicing status.
Risk:
Secure Boot certificate/key changes may alter TPM measured-boot values and trigger BitLocker recovery if BitLocker protection is not suspended first.
Mitigation:
- Confirm current VM backup.
- Confirm BitLocker recovery key.
- Suspend BitLocker protection before certificate enrollment.
- Enroll updated Proxmox EFI certificates while VM is powered down.
- Verify Windows Secure Boot servicing status.
- Resume BitLocker after successful validation.
Commands Summary
Check BitLocker:
manage-bde -status
manage-bde -protectors -get C:
Suspend BitLocker:
manage-bde -protectors -disable C: -RebootCount 0
Alternative:
Suspend-BitLocker -MountPoint "C:" -RebootCount 0
Enroll Proxmox EFI keys:
qm enroll-efi-keys <VMID>
Set Windows Secure Boot update registry value:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" `
-Name AvailableUpdates `
-Type DWord `
-Value 0x5944
Run Windows Secure Boot update task:
Start-ScheduledTask -TaskPath "\Microsoft\Windows\PI\" -TaskName "Secure-Boot-Update"
Verify Windows Secure Boot servicing:
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" `
-Name UEFICA2023Status,UEFICA2023Error,UEFICA2023ErrorEvent
Resume BitLocker:
manage-bde -protectors -enable C:
Alternative:
Resume-BitLocker -MountPoint "C:"
Source References
Proxmox forum - UEFI 2011 certificates expire in June 2026:
https://forum.proxmox.com/threads/uefi-2011-certificates-expire-in-june-2026.183799/
Proxmox VE 9.2 release announcement:
https://forum.proxmox.com/threads/proxmox-virtual-environment-9-2-available.183742/
Microsoft - Secure Boot troubleshooting guide:
https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d
Microsoft - Registry key updates for Secure Boot Windows devices with IT-managed updates:
https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d
Microsoft - manage-bde protectors command:
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors
RSS Feed