小米电脑的安全启动是不是集体出问题了？

PandaFiredoge · 2026 年6 月 3 日 08:52

开启安全启动后，无法引导，显示
SecureBoot Failure
Press Enter to continue next boot device.
只有在BIOS里把安全启动关闭才能进系统

chenyiping1995 · 2026 年6 月 3 日 09:12

是不是因为没更BIOS导致没有导入2023年的证书更新没有推送进去？

PandaFiredoge · 2026 年6 月 3 日 09:13

之前显示已经应用证书更新。

昨天系统出了点问题，我就下载ISO就地重装了一遍，重装之后推了个和当前版本一模一样的更新补丁（我是Insider Beta），更新完就这样了

PandaFiredoge · 2026 年6 月 3 日 10:20

网络搜索了一下，大概是5月20号开始爆发的

Qingwa · 2026 年6 月 3 日 10:33

这个时间证书还没过期

PandaFiredoge · 2026 年6 月 3 日 10:35

然后现在用PowerShell命令检测，显示False，说明证书没有更新

但是证书应该没过期吧，6月底过期

而且小米完全没有为这台电脑发布过任何的BIOS更新，发布即弃子

网络搜索了一下，大概是5月20号开始出现小米电脑安全启动无法进系统的问题，但他们都是更新完BIOS出现的，而我这压根没有BIOS更新

手动更新证书办法没用，因为未开启安全启动的情况下，Windows拒绝进行证书更新，但是开启安全启动之后，又无法进系统

Qingwa · 2026 年6 月 3 日 11:24

现在应该还没过期

fgd · 2026 年6 月 3 日 12:22

~~反正关了安全启动照样用,别折腾了~~

linux下手动写进nvram,出错了进bios恢复出厂密钥

PandaFiredoge · 2026 年6 月 3 日 13:25

所以需要专门装个Linux吗？

fgd · 2026 年6 月 3 日 13:50

拿livecd就能用啊,

PandaFiredoge · 2026 年6 月 3 日 13:51

写完之后不会变砖吧

fgd · 2026 年6 月 3 日 14:09

不是说了可以重置吗你自己进bios看有没有恢复安全启动证书选项

rt23i950 · 2026 年6 月 3 日 14:09

网上有个项目Check-UEFISecureBootVariables，自己更新一下nvarm区

PandaFiredoge · 2026 年6 月 3 日 14:14

我的意思是会不会连BIOS都进不去（“黑砖”）

fgd · 2026 年6 月 3 日 14:18

不会影响bios的，只影响安全启动信任名单

PandaFiredoge · 2026 年6 月 3 日 14:20

这个？

我试一下

PandaFiredoge · 2026 年6 月 3 日 15:12

非常感谢您的回答（以及原仓库、Issue的作者），完成了

github.com/cjee21/Check-UEFISecureBootVariables

Manually install the signed bin files on a running system

已打开 08:45AM - 14 Feb 26 UTC

已关闭 10:33AM - 14 Feb 26 UTC

yzx23333

> [!NOTE] > If the certificate update method involving registry in this reposito…ry does not work, you can try the following method to manually install the certificate update files. --- > [!CAUTION] > This will bypass security check mechanisms related to set UEFI variables in Windows. Please fully understand the function of the relevant files before installation. You may need to reset the Secure Boot settings in the BIOS to continue booting the system. This guide is primarily intended for the proper installation of OEM/Microsoft signed KEK/DB/DBX files, rather than using other workarounds to import them. This might avoid the risks caused by BitLocker. This can be used to install the 2023 KEK certificate and other DB certificates. DBX databases are also supported. ## 1. Preparation On Windows, use the `Show UEFI PK, KEK, DB and DBX.cmd` script from this repository. Run it to query your PK information. *(Linux users please refer to step 5).* Record the unique PK **thumbprint**. You will use this to check if your OEM has uploaded a signed version of the KEK to the Microsoft repository. ## 2. Downloading the KEKUpdate (2023 Certificate) Now prepare to install the KEK signed with the 2023 certificate. Visit: https://github.com/microsoft/secureboot_objects/blob/main/PostSignedObjects/KEK/kek_update_map.json Search for your PK thumbprint. **If found:** Download the correct `.bin` file based on the brand and filename. **If not found:** You cannot install the KEK from the running system under the current PK. *(Skip steps 1 and 2 if you are not installing the KEK).* ## 3. Downloading and Preparing KEK/DB/DBX update files Download the required KEK/DB/DBX files from: https://github.com/microsoft/secureboot_objects/tree/main/PostSignedObjects *(Note: DB and DBX update files are currently still signed with the 2011 KEK certificate. You can also find them in the Windows system path `%SystemRoot%\System32\SecureBootUpdates`).* Obtain the `SplitDbxContent.ps1` script to split the `.bin` files for use on Windows: https://www.powershellgallery.com/packages/SplitDbxContent/1.0 Execute the following in PowerShell to split the signed package. Replace `KEKUpdate_OEMXXX_PKXXX.bin` with your actual filename. ```powershell SplitDbxContent.ps1 KEKUpdate_OEMXXX_PKXXX.bin ``` This will output `content.bin` and `signature.p7` files. All KEK, DB, DBX `XXXUpdate.bin` files in PostSignedObjects need to be split this way. It is recommended to create a new folder to store them to avoid confusion. *(Linux users can skip the split step).* ## 4. Apply the Update ### Windows Users Open PowerShell as Administrator and run the following command to install the KEK: ```powershell Set-SecureBootUefi -AppendWrite -Name KEK -ContentFilePath content.bin -SignedFilePath signature.p7 -Time 2010-03-06T19:17:21Z ``` Please replace the file path as needed. * **Note:** The `-Time` parameter is fixed and cannot be changed. * **Note:** For DB and DBX, replace the value of the `-Name` parameter with the corresponding variable (`DB` or `DBX`). If successful, a table displaying **Name, Bytes, Attributes** will be returned. If an error occurs during the entire certificate verification process, the error code will be `0xC0000022`, and no changes will be made to the UEFI variables. ### Linux Users Use `fwupdtool` or `efi-updatevar` to directly install the `.bin` files downloaded from the Microsoft repository. **No splitting is required.** They come from the `fwupd` and `efitools` packages. ```shell # Requires root permissions fwupdtool install-blob XXXUpdate.bin # or efi-updatevar -f XXXUpdate.bin KEK # (Replace KEK with DB or DBX as needed) ``` ## 5. Verification **Windows Users** Use `Show UEFI PK, KEK, DB and DBX.cmd` or `Check UEFI KEK, DB and DBX.cmd` to check if your certificates were installed successfully. You can view the results without rebooting. **Linux Users** Use the following commands to view the certificate details for each variable: ```shell # Requires root permissions efi-readvar -v KEK # from efitools # (Replace KEK with PK, DB, or DBX as needed) ``` ## Note This guide likely does not apply to any ARM system users, regardless of whether using Windows or Linux. The above steps were only tested on my computer and may not apply to all devices. **The Linux instructions provided in this guide have not been tested by the author.** They are from the wiki mentioned below. Part of the content comes from https://github.com/microsoft/secureboot_objects/wiki

6949 · 2026 年6 月 4 日 00:23

所以这个到底是谁的问题呀，小米还是系统问题呀

hooke007 · 2026 年6 月 4 日 02:39

关于小米笔记本 Windows 安全启动证书更新的公告说明

看来主楼说的是这个问题

herper · 2026 年6 月 7 日 23:39

小米的工程师回复我的，旧版本机器无法提供KEK，他们不再提供技术支持，也就是说没有BIOS或其他方案更新证书，所以旧版本小米笔记本没有安全启动证书更新！所以笔记本，还是大厂吧！

话题		回复	浏览量
如何手动在UEFI内导入安全启动证书讨论分享 windows , 笔记本电脑 , 安全 , pc	6	301	2026 年6 月 8 日
微软提醒：Windows 11 安全启动证书快过期了｜不更新会怎样？青蛙的应用	7	339	2026 年5 月 29 日
请问小米笔记本磁盘是默认BitLocker加密嘛? 问题求助 windows	21	8511	2021 年7 月 6 日
Windows10更新不可用。问题求助 windows	8	1769	2022 年11 月 7 日
Win10 msconfig 设置无法保存问题求助 windows	4	2851	2022 年4 月 18 日

小米电脑的安全启动是不是集体出问题了？

相关话题