BIOS update and fear :O)

[6730b]

Even after dozens and dozens of successful flashes on all kinds of machines, the fear of imminent catastrophy & destruction always surfaces from somewhere, maybe over the years ones genes \ DNA got mutated to include digital fear & anxiety as a most basic survival tool :O)

And yes, all well this time too !

[MELOCODI]

Girls: Do men even have feelings?

Boys: Scary BIOS flash bar

[kojack]

Is what it is, if my systems crash because of a bios update and they die, I will get a new one.  Hopefully its my desktop since I can change out the mother board, case and PSU then have a new fully running system again without too much trouble.  If it's ny notebook, then I guess one of the few new systems I am looking at will be ordered. 

[6730b]

And survived another one :O) along with a mysterious 'TPM 2.0 firmware update'. Both labeled CRITICAL
Mixing such updates with Bitlocker = suspense until sucessful boot. Got 100% trust in bitlocker itself, but way less in new firmwares' possible implications (and in own deads ...or misdeads lol). Of course got backups of contents and keys ready if anything should ever go overboard.

[6730b]

And another one for the 5540...that feeling of imminent ☠️, but all went well.

[kojack]

I did my 3 dells today.  The bios update made them all much faster.  I think the previous one screwed alot of things up.  My system is now quiet, fast, and has better battery life.  Went from 4.5 to over 9 hrs.  The previous bios upgrade screwed everything in the system.

[6730b]

And another one. All well, still impressed each time nothing is bricked.
Must be the 10th or so since I got the prec 5540 3.5 y ago.
Solid support work from Dell.

Picture:
😬 🤔 no way back...

[kojack]

Just checking my system again now for any new bios updates.  Roll the dice!

[6730b]

And another one, lots of Intel security stuff. All well once more, seems Dell does good homework.
Appreciating the launch setup from within windows.

[6730b]

Another one done, must be closer to the 15th since getting the Precision. All well, did not need the valium :O)
Impressed by Dell for providing regular security updates for quite old machines ...and without any bricking.
 

[ygohome]

I think the Microsoft Secure Boot certificate keys that are in our BIOS are set to expire sometime in 2026.  

Laptop manufacturers, such as DELL, are pushing out new BIOS updates so that the new Microsoft Secure Boot certs are in those BIOS' KEKList.

 

I'm wondering though about my older Dell laptop Precision 7710, which no longer receives BIOS updates.  The last 7710 BIOS update is from April 2023.  Worst case scenario after MS Secure Boot certs expire, do I disable secure boot on my 7710 and I'll still be able to boot into Win11?  Or should I start looking into a new Windows laptop workhorse:  Dell Pro Max :D 

 

 

 

 

[Aaron44126]

10 minutes ago, ygohome said:

I think the Microsoft Secure Boot certificate keys that are in our BIOS are set to expire sometime in 2026.  

Laptop manufacturers, such as DELL, are pushing out new BIOS updates so that the new Microsoft Secure Boot certs are in those BIOS' KEKList.

 

I'm wondering though about my older Dell laptop Precision 7710, which no longer receives BIOS updates.  The last 7710 BIOS update is from April 2023.  Worst case scenario after MS Secure Boot certs expire, do I disable secure boot on my 7710 and I'll still be able to boot into Win11?  Or should I start looking into a new Windows laptop workhorse:  Dell Pro Max 😄

 

You won't get cert failures if you system rolls past the cert expiration date. The signature includes the date/time at which it was signed and that is what gets checked as part of the validation process, not the current system time. (The same is true for checking the signature of other static things, like .exe's, drivers, etc.)

 

You will have a problem if/when Microsoft pushes out a new bootloader which is only signed by certificates which your BIOS doesn't recognize. You'd have to disable secure boot in this case.

 

(This "shouldn't" be possible because you "shouldn't" be running Windows 11 on your system, as it doesn't meet the requirements. You're already running it "unsupported", "at your own risk".)

 

Microsoft normally doesn't touch the bootloader as part of monthly patching, but they could. But it will almost certainly be touched if a "major" upgrade to Windows 11 comes along ... if they push out their annual fall release and it is not just released as an "enablement package".

 

You could also jump through hoops to add your own certificate to the BIOS (it does support custom certs) and then sign the bootloader with that. Actually... You could probably just manually load in Microsoft's new cert as a custom cert and then that would be fine.

[ygohome]

On 11/24/2025 at 2:27 PM, Aaron44126 said:

 

You won't get cert failures if you system rolls past the cert expiration date. The certificate includes the date/time at which it was signed and that is what gets checked as part of the validation process, not the current system time. (The same is true for checking the signature of .exe's, drivers, etc.)

 

You will get errors if Microsoft pushes out a new bootloader which is only signed by certificates which your BIOS doesn't recognize. You'd have to disable secure boot in this case.

 

(This "shouldn't" be possible because you "shouldn't" be running Windows 11 on your system, as it doesn't meet the requirements. You're already running it "unsupported", "at your own risk".)

 

You could also jump through hoops to add your own certificate to the BIOS (it does support custom certs) and then sign the bootloader with that.

That makes sense.  I'll probably continue by disabling secure boot on the 7710, if/when MS pushes out the new bootloader with new signed certs.   Yeah, I've had to update the 7710 to latest April 2023 BIOS, TPM firmware update to 2.0 and also created the regedit entry to ignore CPU requirements to install win11.  But it's still great system, and fully unsupported (I mean, it's 10 yrs old)