Missing PK-signed KEK for Hyper-V VM, Microsoft Hyper-V Firmware PK, with Serial

[gunnarhaslinger]

Trying to Install 2023 KEK Update in a Microsoft Hyper-V based VM but only getting error EventID 1795 ... found out the PK of my VM is not covered by this:

"8058e8cc51749652804bbd6f39aed713d119c64b": {
        "KEKUpdate": "Microsoft\\KEKUpdate_Microsoft_PK1.bin",
        "Certificate": {
            "serial_number": 171049019130091589582073331848314912,
            "issued_to": "CN=Microsoft Hyper-V Firmware PK,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US",
            "issued_by": "CN=Microsoft Corporation Third Party Marketplace PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US"
        }
    },

But instead my VM uses this PK:

serial_number HEX: 3300000020F15E25249FAB75D0000000000020 
serial_number Decimal: 1137338005296110799348413221487139768653316128
issued_to: CN=Microsoft Hyper-V Firmware PK, O=Microsoft Corporation, L=Redmond, S=Washington, C=US 
issued_by: CN=Microsoft Corporation Third Party Marketplace PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Does Microsoft have different Certificates for Hyper-V VMs? Maybe based on Generation?

[gunnarhaslinger]

I tried to find out if the meta-data in kek_update_map.json is correct, following the steps for OEMs in the Wiki.

But without luck, all Microsoft-PK-signed bin-Files are not able to be decoded:

PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK1.bin
2025-11-25 16:14:48,809 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK2.bin
2025-11-25 16:15:19,198 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK3.bin
2025-11-25 16:15:22,617 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK4.bin
2025-11-25 16:15:25,178 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK5.bin
2025-11-25 16:15:28,564 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK6.bin
2025-11-25 16:15:31,651 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK7.bin
2025-11-25 16:15:34,520 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK8.bin
2025-11-25 16:15:37,638 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK9.bin
2025-11-25 16:15:41,213 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK10.bin
2025-11-25 16:15:44,073 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK11.bin
2025-11-25 16:15:46,581 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK12.bin
2025-11-25 16:15:49,847 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK13.bin
2025-11-25 16:15:52,571 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK14.bin
2025-11-25 16:15:54,856 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK15.bin
2025-11-25 16:15:57,536 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK16.bin
2025-11-25 16:16:01,252 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK17.bin
2025-11-25 16:16:05,838 - ERROR - Error: No matching certificate found for the signer
PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Microsoft\KEKUpdate_Microsoft_PK18.bin
2025-11-25 16:16:08,738 - ERROR - Error: No matching certificate found for the signer

When I try the same with a Dell-signed KEK it works:

PS C:\Users\gh\GitHub\secureboot_objects> python .\scripts\examples\get_auth_var_signing_certificate.py .\PostSignedObjects\KEK\Dell\KEKUpdate_Dell_PK1.bin
2025-11-25 16:16:39,564 - INFO - Signing certificate extracted successfully.
2025-11-25 16:16:39,565 - INFO - SHA1 thumbprint 38a346b84c0e230ca4f235e7355b872460770264
2025-11-25 16:16:39,565 - INFO - SHA256 thumbprint ceab902ec4868abf44a45c9ae98f23dd7aea2041e0663d574bc522b7a461e204
2025-11-25 16:16:39,566 - INFO - Certificate saved as '.\PostSignedObjects\KEK\Dell\KEKUpdate_Dell_PK1.bin_signing_certificate.der'

Continued to check those for Lenovo and HP ... they can be decoded too.
So I think my environment (python 3.13) doesn't seem to be the issue, I guess the content of the KEK\Microsoft folder is kind of strange.

So I'm not sure if this Meta-Data about "Microsoft Hyper-V Firmware PK" in kek_update_map.json is even correct.

[Flickdm]

See #325.

So, there is an RFC that requires certificates use positive integers. However many of these certificates were created before that RFC existed. This was causing it to fail for some certificates so I changed it to present things similar to certutil. There is nothing strange about the contents of the certs, just a script with edge cases that I threw together as an example for how to determine which payload to apply for LVFS / Linux.

This repo was meant to help provide the files so that Linux could also perform cert rolling through LVFS or some similar mechanism. Updating the certs manually on windows could lead to VSM or bitlocker losing their secrets - so I think the plan is to let windows apply it. Let me see what the plan is for HyperV.

[Flickdm]

Gunnar Haslinger (@gunnarhaslinger) So two updates,

1. HyperV does not yet support KEK updates (this is coming very soon)
2. The KEK update file here will need to be updated when the hyperV team is ready.

Keep an eye out for more information - as an FYI Windows Update will add support to apply the payload when its available and the firmware supports it

I'm backlogging this for now until I get the updated payload.

[gunnarhaslinger]

Thanks for this Information Doug Flick (@Flickdm), highly appreciated!

[jamesaepp]

Keep an eye out for more information - as an FYI Windows Update will take care of applying the payload when its available and the firmware supports it - so no manual work should need to happen

Happy to hear this the case but got to say I'm kinda shocked that Hyper-V is not already updated. You'd think this all being first-party that Microsoft would have been way ahead of the game on this.

[Flickdm]

Just to clarify here - the exact instructions to enable this update may require additional steps I'm not currently familiar with. Which when available I'll link to here and update the payload. However, manually applying the payloads available in this repo - in most cases - should not be necessary and may impact bitlocker / vsm. Linux distros running in HyperV that utilize LVFS will also be able to apply it.

[Flickdm]

As an update, my understanding is that we are targeting March for the Hyper-V update.

[ejioforobi2015-lab]

https://techcommunity.microsoft.com/blog/windows-itpro-blog/secure-boot-playbook-for-certificates-expiring-in-2026/4469235/replies/4470090

You don't have to delete the Hyper-V VM and create a new one to update the KEK on older VMs.

• turn off the VM
• change the SecureBoot Template to "Microsoft UEFI Certificate Authority"
• click Apply
• change the Template back to "Microsoft Windows"
• click ok.

[hibo98]

ejioforobi2015-lab This does not work if TPM is enabled. Because Hyper-V does not let you change the SecureBoot Template, if TPM is enabled.

[PehDeh]

Hi Gunnar Haslinger (@gunnarhaslinger) Doug Flick (@Flickdm)
i just tested it on a Windows Server 2022 Datacenter VM running on Hyper-V with March 2026 Updates, it still fails to update the KEK and get the VM in an Updated state.
Any news?

[gunnarhaslinger]

I can confirm: Updating KEK and DB Certificates inside a Hyper-V VM (in my case it is a Win11 Hyper-V VM running on an Win11 HyperV Host) works with Win11 v25H2 Patch-Tuesday 10.03.2026 Hotfixes applied.

[jamesaepp]

Gunnar Haslinger (@gunnarhaslinger) my understanding is Microsoft's "assists" including CFR and LCU updates don't apply to server SKUs so admins will still need to (somehow, directly or indirectly) get the one regkey set to 0x5944. Is that the case?