I'm wondering if I have to update the secure boot keys myself or if they'll be taken care of automatically, maybe through Windows Update? I came across a procedure on how to manage the Windows boot manager revocations, but I'm clouded on what exactly I need to do. Also, I got a notice from Rufus saying that my Windows 11 24H2 ISO downloaded via the Media Creation Tool has outdated certificates from 2011. Is this going to create any issues when I try to upgrade to 24H2 tomorrow or whenever I decide to update my computer?
2 Answers
Generally speaking, the new Windows UEFI CA 2023 should be added to the UEFI database. The previous 2011 certificates haven't been revoked yet, so if you're using an older version of Rufus that doesn’t include the new CA2023 references, and you haven’t manually revoked any certificates, you should still be able to upgrade to 24H2. Just make sure your computer officially supports Windows 11. If it does, you'll also be able to upgrade to 25H2 later on. You’ll receive the necessary certificate updates via Windows Update, provided that secure boot is enabled and you're a home user on either Home or Pro editions. In organizations, the IT team typically manages these updates.
From what I’ve read, the developer of Rufus added a feature in version 4.10 that allows the inclusion of CA 2023 in the ISO, but that’s specific to the new Windows 11 25H2 ISO. Unfortunately, it doesn’t apply to the 24H2 ISO you're using.
Got it, my computer is an 8th Gen Intel, so it should be fine for Windows 11 support. Is it safer to just leave everything as is, or are threats like 'Black Lotus' really a concern for home users? I’m leaning towards sticking with 24H2 for now until some bugs are fixed in 25H2.