Invalid signature detected. Check secure boot policy in setup

[SeriousHoax]

Official FAQ

• I have checked the official FAQ.

Ventoy Version

1.0.76

What about latest release

Yes. I have tried the latest release, but the bug still exist.

BIOS Mode

UEFI Mode

Partition Style

MBR

Disk Capacity

16

Disk Manufacturer

ADATA

Image file checksum (if applicable)

No response

Image file download link (if applicable)

No response

What happened?

I updated my motherboard's BIOS yesterday to the latest version F63b, which includes fixes for TPM related stuttering.
https://www.gigabyte.com/Motherboard/B450M-S2H-rev-1x/support#support-dl-bios
After that, my BIOS settings were changed and I had to restore keys to default in order to enable Secure Boot. I guess after that imported Ventoy certificate that I did a long time ago while installing Ventoy for the first time got removed.
Now when I try to boot my Flash drive by selecting the ventoy partition which is partition 2 in my case, I can't get into ventoy. The BIOS throws an error saying, "Invalid signature detected. Check secure boot policy in setup".
I can't go into the mokmanager to enroll certificate. I'm stuck. The only way to use Ventoy now is to disable secure boot.
I guess the latest BIOS don't trust the certificate anymore. Anyway, I'm not an expert.
Can you do something to fix this?

[ventoy]

Did you update your Ventoy to the latest 1.0.76 and make sure have enabled the Secure Boot Support option?
Please upload a screenshot of the Ventoy2Disk.exe GUI here.

[SeriousHoax]

Did you update your Ventoy to the latest 1.0.76 and make sure have enabled the Secure Boot Support option?
Please upload a screenshot of the Ventoy2Disk.exe GUI here.

Yes, I did both. I always update Ventoy when a new version is released. I have been using Ventoy for a while so I'm aware of this. I even completely removed from Ventoy from my flash drive and reinstalled it with version 1.0.75 and then updated it to 1.0.76 yesterday. Secure boot option is also enabled. But still getting the error.
I'm not on my PC at the moment. I'll share the screenshot later if you want. But I'm sure I did my part correctly.

[ventoy]

OK.
If you did right. Then it's not about the certificate, it's about the shim.
https://github.com/ventoy/Ventoy/blob/master/INSTALL/EFI/BOOT/BOOTX64.EFI
This file is actually a shim (v15-8), from Fedora, signed with Microsoft key.

Your BIOS reported Invalid signature detected it means that your BIOS doesn't trust the BOOTX64.EFI file.
It should be accepted because it was signed with Microsoft key and almost all the BIOS will integrate Microsoft key by default.

Only the BIOS accept BOOTX64.EFI file and boot it, otherwise you have no chance to enroll the key.
The enrolled Ventoy key is for other files, not for the BOOTX64.EFI file, because it was signed with Microsoft key and should be accepted by the BIOS by default.

[SeriousHoax]

Oh, I see. I tried the Enroll efi image option in my BIOS and selected the BOOTX64.EFI which then added it to something like Authorized certificate or something. Forgot the exact name. I thought it might work but it didn't.
I'll share some screenshots later.

[steve6375]

Does the BIOS have an option to 'Load default keys'?

[SeriousHoax]

Does the BIOS have an option to 'Load default keys'?

Yeah, I think it has. Should I try it?

[steve6375]

yes.

[SeriousHoax]

yes.

There is "Restore Factory Keys". But no luck even after doing that.

[SeriousHoax]

Here are the screenshots.

Screenshot:

[rwasef1830]

@SeriousHoax try to erase the revocation key list in bios (forbidden keys)

[SeriousHoax]

@SeriousHoax try to erase the revocation key list in bios (forbidden keys)

It worked after deleting the fourth item on the list, which contains 183 forbidden signatures. There's no way to choose. It deletes all of them. I guess among these there are malicious signatures also which could be used by malware that attacks UEFI. Deleting all 183 of them is not an ideal solution, I suppose. Maybe a new certificate has to be used that's not blacklisted. Otherwise, users won't be able to use Super-UEFIinSecureBoot-Disk or Ventoy in the future.

[rwasef1830]

Looks like they have 183 specific SHA256 hashes blacklisted. Probably the shim version used is one of them. My BIOS is the same also.

[SeriousHoax]

Looks like they have 183 specific SHA256 hashes blacklisted. Probably the shim version used is one of them. My BIOS is the same also.

Hmm, you're right, it seems. I hope the devs will be able to come up with a solution.

[rwasef1830]

Another report here https://www.youtube.com/watch?v=w8r-U2C7UMs