VB 7.2.8 linux host + Win11 guest reports " ... does not support the automated Secure Boot certificate update ..."?

[p797845]

On Fedora 44, I'm running

Code: Select all

VirtualBox-7.2-7.2.8_173730_fedora40-1.x86_64

from Oracle/VB upstream repo.

My VB guest is

Code: Select all

Edition Win11 Pro
	Version 25H2
	OS Build 26200.8655
	Experience Windows Feature Experience Pack 1000.26100.315.0

Guest config has

Code: Select all

	System ->
		Motherboard ->
			Features
				[X] UEFI
				[X} Secure Boot

On guest launch I get a Windows Security warning icon.

In the settings

Code: Select all

	Windows Security ->
		Device security ->
			"Secure Boot is on, but your device does not support the automated Secure Boot certificate update due to hardware or firmware limitations.  Contact your device manufacturer for assistance."

I set up the Group Policy in Win11 by following

"Group Policy Objects (GPO) method of Secure Boot for Windows devices with IT-managed updates"
h t t p s :// support . microsoft . com/en-us/topic/group-policy-objects-gpo-method-of-secure-boot-for-windows-devices-with-it-managed-updates-65f716aa-2109-4c78-8b1f-036198dd5ce7

but still get the "... device does not support ..." warning.

First Microsoft Cert Expiration is apparently in ~ 2 weeks.

How do you get these Secure Boot certs correctly updated for the VB guest?

[klaus]

You can add the updated certificates through the command line (they will not be refreshed from the GUI). Thought that 7.2.8 had all the cert DB update issues already sorted, but maybe not. 7.2.10 coming soon.

[p797845]

@klaus

> You can add the updated certificates through the command line

with current 7.2.8,

following

(support dot microsoft dot com)/en-us/topic/windows-configuration-system-wincs-apis-for-secure-boot-d3e64aa0-6095-4f8a-b8e4-fbfda254a8fe

@ guest command prompt

Code: Select all

C:\Windows\System32> WinCsFlags.exe /query --key F33E0C8E002

Flag: F33E0C8E
  Current Configuration: F33E0C8E002
  State: Enabled
  Pending Configuration: None
  Pending Action: None
  CVE: CVE-2026-21265
  FwLink: https://(aka dot ms)/getsecureboot
  Available Configurations:
    F33E0C8E001
    F33E0C8E002

C:\Windows\System32>

then, at PowerShell prompt < -administrator, exec'd

Code: Select all

> Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"​

restart the VB Guest
restart the VB Guest, again

then, check

Code: Select all

PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
>>
True
PS C:\WINDOWS\system32>

but STILL have that Windows Security notice/warning, as above

not sure if that's sufficient; MS's "guidance" is a bit ... opaque.

in any case, i'll keep an eye out for 7.2.10 ...

[klaus]

Sorry for being a bit opaque myself - yesterday was super busy and I didn't have the time to dig out the command.

What I meant was updating the secure boot certificate databases from the host (needs the VM to be shut down):

VBoxManage modifynvram "vmname" enrollmssignatures

And the necessary fixes are actually all in 7.2.8 already, but are not applied to existing VMs (just when creating new ones) because a normal PC also wouldn't "magically" change the UEFI database variables related to secure boot.

[p797845]

ah. THAT command line ;-)

Code: Select all

$ VBoxManage list vms
	"Win11_64" ...
$ VBoxManage modifynvram "Win11_64" enrollmssignatures
$

boot VM
... wait ~ 5 minutes progress ...

@ guest,

still the MS Security WARNING/Notice flag.

exec

Code: Select all

Microsoft Windows [Version 10.0.26200.8655]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\System32>WinCsFlags.exe /query --key F33E0C8E002

Flag: F33E0C8E
  Current Configuration: F33E0C8E002
  State: Enabled
  Pending Configuration: None
  Pending Action: None
  CVE: CVE-2026-21265
  FwLink: ... aka.ms/getsecureboot
  Available Configurations:
    F33E0C8E001
    F33E0C8E002

C:\Windows\System32>

then,

Code: Select all

PS C:\WINDOWS\system32> Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

restart.
again,

Code: Select all

PS C:\WINDOWS\system32> Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

restart, again,

check,

Code: Select all

PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
	True
PS C:\WINDOWS\system32>

and, the Security WARNING's gone -- 'all green'

Screenshot_20260612_124033.png (68.9 KiB) Viewed 5582 times

[p797845]

@klaus

I upgraded this "fixed/working" 7.2.8 instance to just-released 7.2.10

Code: Select all

VirtualBox Graphical User Interface
Version 7.2.10 r174163 (Qt6.8.0 on xcb)
Copyright © 2026 Oracle and/or its affiliates.

same Win11 guest

checking config SecureBoot IS checked

guest launch, now fails

Code: Select all

VM Name: Win11_64

Host API has not enabled SVME bit in EFER MSR. (VERR_SVM_HOST_SVME_NOT_ENABLED).
Result Code:
NS_ERROR_FAILURE (0x80004005)
Component:
ConsoleWrap
Interface:
IConsole {6ac83d89-6ee7-4e33-8ae6-b257b2e81be8}

i can RE-apply everything i tried above, but that seems ... unexpected.

is it expected that the reapply would be required?

EDIT: well, no i can't actually. I can't boot the Guest ...

[p797845]

same reported here

https://github.com/VirtualBox/virtualbox/issues/713

[klaus]

The workaround is in the ticket... it's a completely unrelated issue.

[p797845]

yup.

removal of

Code: Select all

kvm.enable_virt_at_load=0

, original refs

https://discussion.fedoraproject.org/t/ ... /139896/17
https://lore.kernel.org/kvm/ZwQjUSOle6s ... gle.com/T/

works around the issue (unclear yet what the perf consequences are .... keeping an eye on the bug, there)

as far as _this_ SecureBoot cert update issue, once originally fixed as above, still good here.