Just opening this first "Issue" to say thank you.
This CERTCC/PKfail project is a very convenient solution for systems the vendor is not willing to provide proper UEFI-Firmware-Updates. Thank you so much, the idea of using the "disclosed" private-keys of the "DO NOT TRUST - AMI Test PK" certificates to change them to Microsofts "Windows OEM Devices PK" is just brilliant!
This solution even works in WinPE for automated deployments. Just comment out the lines regarding Bitlocker-checking which are not operational in WinPE.
Thank you,
best regards!
PS: Checked if your Ami-windowspk_content.bin is binary-identical with LegacyFirmwareDefaults\Firmware\DefaultPk.bin in official Microsoft SecureBoot Objects Repository https://github.com/microsoft/secureboot_objects/releases/download/v1.6.2/edk2-x64-secureboot-binaries.zip
✅ Yes, it is!
Just opening this first "Issue" to say thank you.
This CERTCC/PKfail project is a very convenient solution for systems the vendor is not willing to provide proper UEFI-Firmware-Updates. Thank you so much, the idea of using the "disclosed" private-keys of the "DO NOT TRUST - AMI Test PK" certificates to change them to Microsofts "Windows OEM Devices PK" is just brilliant!
This solution even works in WinPE for automated deployments. Just comment out the lines regarding Bitlocker-checking which are not operational in WinPE.
Thank you,
best regards!
PS: Checked if your
Ami-windowspk_content.binis binary-identical withLegacyFirmwareDefaults\Firmware\DefaultPk.binin official Microsoft SecureBoot Objects Repository https://github.com/microsoft/secureboot_objects/releases/download/v1.6.2/edk2-x64-secureboot-binaries.zip✅ Yes, it is!