Repository navigation
Missing PK-signed KEK for Hyper-V VM, Microsoft Hyper-V Firmware PK, with Serial #318
Description
Trying to Install 2023 KEK Update in a Microsoft Hyper-V based VM but only getting error EventID 1795 ... found out the PK of my VM is not covered by this:
"8058e8cc51749652804bbd6f39aed713d119c64b": {
"KEKUpdate": "Microsoft\\KEKUpdate_Microsoft_PK1.bin",
"Certificate": {
"serial_number": 171049019130091589582073331848314912,
"issued_to": "CN=Microsoft Hyper-V Firmware PK,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US",
"issued_by": "CN=Microsoft Corporation Third Party Marketplace PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US"
}
},
But instead my VM uses this PK:
serial_number HEX: 3300000020F15E25249FAB75D0000000000020
serial_number Decimal: 1137338005296110799348413221487139768653316128
issued_to: CN=Microsoft Hyper-V Firmware PK, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
issued_by: CN=Microsoft Corporation Third Party Marketplace PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Does Microsoft have different Certificates for Hyper-V VMs? Maybe based on Generation?
Reacted by PehDeh
Activity
gunnarhaslinger commentedon Nov 25, 2025
I tried to find out if the meta-data in kek_update_map.json is correct, following the steps for OEMs in the Wiki.
But without luck, all Microsoft-PK-signed bin-Files are not able to be decoded:
When I try the same with a Dell-signed KEK it works:
Continued to check those for Lenovo and HP ... they can be decoded too.
So I think my environment (python 3.13) doesn't seem to be the issue, I guess the content of the
KEK\Microsoftfolder is kind of strange.So I'm not sure if this Meta-Data about "Microsoft Hyper-V Firmware PK" in kek_update_map.json is even correct.
Flickdm commentedon Nov 29, 2025
See #325.
So, there is an RFC that requires certificates use positive integers. However many of these certificates were created before that RFC existed. This was causing it to fail for some certificates so I changed it to present things similar to certutil. There is nothing strange about the contents of the certs, just a script with edge cases that I threw together as an example for how to determine which payload to apply for LVFS / Linux.
This repo was meant to help provide the files so that Linux could also perform cert rolling through LVFS or some similar mechanism. Updating the certs manually on windows could lead to VSM or bitlocker losing their secrets - so I think the plan is to let windows apply it. Let me see what the plan is for HyperV.
Flickdm commentedon Dec 16, 2025
Gunnar Haslinger (@gunnarhaslinger) So two updates,
Keep an eye out for more information - as an FYI Windows Update will add support to apply the payload when its available and the firmware supports it
I'm backlogging this for now until I get the updated payload.
gunnarhaslinger commentedon Dec 16, 2025
Thanks for this Information Doug Flick (@Flickdm), highly appreciated!
jamesaepp commentedon Jan 14, 2026
Happy to hear this the case but got to say I'm kinda shocked that Hyper-V is not already updated. You'd think this all being first-party that Microsoft would have been way ahead of the game on this.
Flickdm commentedon Jan 20, 2026
Just to clarify here - the exact instructions to enable this update may require additional steps I'm not currently familiar with. Which when available I'll link to here and update the payload. However, manually applying the payloads available in this repo - in most cases - should not be necessary and may impact bitlocker / vsm. Linux distros running in HyperV that utilize LVFS will also be able to apply it.
Flickdm commentedon Jan 20, 2026
As an update, my understanding is that we are targeting March for the Hyper-V update.
ejioforobi2015-lab commentedon Mar 9, 2026
https://techcommunity.microsoft.com/blog/windows-itpro-blog/secure-boot-playbook-for-certificates-expiring-in-2026/4469235/replies/4470090
You don't have to delete the Hyper-V VM and create a new one to update the KEK on older VMs.
hibo98 commentedon Mar 9, 2026
ejioforobi2015-lab This does not work if TPM is enabled. Because Hyper-V does not let you change the SecureBoot Template, if TPM is enabled.
PehDeh commentedon Mar 11, 2026
Hi Gunnar Haslinger (@gunnarhaslinger) Doug Flick (@Flickdm)
i just tested it on a Windows Server 2022 Datacenter VM running on Hyper-V with March 2026 Updates, it still fails to update the KEK and get the VM in an Updated state.
Any news?
gunnarhaslinger commentedon Mar 11, 2026
I can confirm: Updating KEK and DB Certificates inside a Hyper-V VM (in my case it is a Win11 Hyper-V VM running on an Win11 HyperV Host) works with Win11 v25H2 Patch-Tuesday 10.03.2026 Hotfixes applied.
jamesaepp commentedon Mar 11, 2026
Gunnar Haslinger (@gunnarhaslinger) my understanding is Microsoft's "assists" including CFR and LCU updates don't apply to server SKUs so admins will still need to (somehow, directly or indirectly) get the one regkey set to 0x5944. Is that the case?
Arcelone commentedon Mar 11, 2026
Gunnar Haslinger (@gunnarhaslinger)
What version of hyper-V and host OS do you use and which vm firmware version ?
8 remaining items
dirt-devil commentedon Mar 12, 2026
Did the March update included the PK certificates for Hyper-V hosted machines?
jamesaepp commentedon Mar 16, 2026
I can confirm a couple tests today verify Arden White (@ArdenWhite)'s comment above.
dirt-devil commentedon Mar 17, 2026
All our WS2019 machines had the March LCU installed and the KEK and DB updated with no problems.
My concern is the PK for the HV machines (including the host), it expired in 2014, will an update be available or should it be ignored? Even WS2025 HV has it expired.
jamesaepp commentedon Mar 17, 2026
My understanding is that PK expirations aren't enforced. I've never seen that idea backed up by (open source/access) sources though such as UEFI specs. Would love a primary source.
dirt-devil commentedon Mar 17, 2026
James Epp (@jamesaepp) maybe Arden White (@ArdenWhite) can provide clarification?
mirtelo commentedon Mar 23, 2026
Hi, i´m still getting Error 1795 for KEK on Hyper-V Gen2 VMs with Inplace Update History. VM and Hyper-V Host are on March LCU
The system firmware returned an "Access denied" error when attempting to update a Secure Boot variable KEK 2023. The signature information for this device is listed here. DeviceAttributes: FirmwareManufacturer:Microsoft Corporation;FirmwareVersion:Hyper-V UEFI Release v4.1;OEMModelNumber:Virtual Machine;OEMManufacturerName:Microsoft Corporation;OSArchitecture:amd64; BucketId: 4e22d051e8c143d2875b9d16ef2241c7ec548985a21e5073126d3c1f9bf53bb2 BucketConfidenceLevel: Under Observation - More Data Needed. For more information, see https://go.microsoft.com/fwlink/?linkid=2169931
I can Workaround the Problem with changing the Secureboot Template. Is this a supported solution for this Problem ? CoPilot tells me no, and says that i had to Recreate the VM.
What consequences might this workaround have for the future?
ArdenWhite commentedon Mar 23, 2026
mirtelo be sure that you apply the March updates to both the Hyper-V host and the Hyper-V guests. There were two fixes made - one to address the NVRAM support on the host and one to add a PK signed KEK that the guest can apply to the virtualized firmware.
Arden - Microsoft
mirtelo commentedon Mar 23, 2026
I´m sure that the March Updates are applied to Hyper-V Host und Hyper-V Guest.
Regards
Martin
ArdenWhite commentedon Mar 23, 2026
Hi Martin,
I'm sorry you're having this trouble.
Yes, it does look like you have the latest updates. Could it be that you applied the hot-patch version of KB5078766 to the Windows Server 2022? The hot-patch updates only contain security fixes. To get the Secure Boot fixes, you'll need to reboot and apply the cold-patch version of KB5078766.
Arden - Microsoft
dirt-devil commentedon Mar 23, 2026
Arden White (@ArdenWhite)
Have all my 2019 and 2025 hosts with the 2026-03 Cum Update, all keys updated just fine.
All my 2019 and 2025 Hyper-V machines have the 2026-03 Cum Update, KEK and DB updated but the PK is expired (has been expired since 2014).
Is there a way to update the Hyper-V PK certificate or leave it as is?
mirtelo commentedon Mar 23, 2026
Arden White (@ArdenWhite): We dont use Hotpatch for our Hyper-V Hosts.
So as described the Problem only occures on Hyper-V Guest which were Inplace Updated from W2K16 to W2K22.
I can Workaround the Problem with changing the Secureboot Template in Hyper-V when the VM is powered off. But I´m not sure if this is a supported Mircosoft Solution for this Problem.
jamesaepp commentedon Mar 23, 2026
FWIW I think the original topic of this issue is resolved, as the PK signing is now present. I think new issues are better. I've started #370 to maybe steer questions there as I think documentation would help address a lot of questions across a wider audience.
dirt-devil / mirtelo et al - I recommend the above issue or new ones.
Doug Flick (@Flickdm) and Gunnar Haslinger (@gunnarhaslinger) - is the original nature of this issue solved to both of your satisfaction?
dirt-devil commentedon Mar 23, 2026
James Epp (@jamesaepp) OK, will discuss there. Thanks
Flickdm commentedon Mar 25, 2026
For what its worth, I'll close the issue and if there's any reason to reopen it - I can