How to Handle Secure Boot Certificate Rollout on VMware VMs?

I managed the whole upgrade process on ESXi 8U3 without any hiccups:
1. Shut down the VM and take a snapshot.
2. Upgrade the hardware version to vmx-21.
3. Use the datastore browser to rename the NVRAM file.
4. Boot up the VM and check everything works.
5. Use the registry method to update Secure Boot, then remove the snapshot if all goes well.
This approach worked seamlessly, including for VMs with vTPM, though remember that it may trigger BitLocker if you have it enabled. Have your recovery key handy. Also, if time-sensitive, you can manage the clock reset by setting a specific parameter before the first boot.

According to our Technical Account Manager, this is a wait-and-see situation that should be resolved with an update. You might want to clarify if they mean a VMware patch or a Microsoft update for the OS itself. It’d be helpful to get a specific KB article or release number to keep track of, given the deadline approaching.

I followed the instructions from Broadcom’s documentation and manually updated a small batch of VMs without issues. Here's the process I used:
1. Create an HDD and attach it to the VM.
2. Copy the required certificate to that HDD.
3. Detach the HDD and power down your target VM.
4. Re-attach the HDD, make some configuration changes, boot into UEFI, select the new certificate, then disconnect the HDD again before booting normally. It’s a bit like using a USB drive for file transfers.

Check out this GitHub tool: it automates most of the verification process for you (though it won't upgrade you to ESXi 8.0.2+). I’ve mainly used the -Assess switch so far, but it seems promising for remediation. Also, Broadcom is collaborating with Microsoft to streamline this process, so keep an eye out for potential updates that may make it easier soon!