Manual Update of the Secure Boot Platform Key in Virtual Machines running on Workstation

Products

• VMware Workstation
• VMware Fusion

Issue/Introduction

Virtual machines that do not have a valid Platform Key (PK) fail to complete automated updates to Secure Boot databases, including DB, DBX, and KEK.

Environment

• Workstation 26H1
• Workstation 25H2
• Workstation 17.6.x
• Fusion 26H1
• Fusion 25H2
• Fusion 17.6.x

Cause

The Platform Key (PK) on virtual machines has an invalid signature, which causes updates to the Key Exchange Key (KEK) database to fail. As a result, the automated Secure Boot update process fails and reports error events or logs.

Resolution

Note: If a vTPM is present and disk encryption software (such as BitLocker on Windows or LUKS on Linux) is sealed to specific TPM PCR registers, preparatory steps are required before performing the key update. These steps include creating a VM snapshot, saving the recovery key (for BitLocker-type solutions), or temporarily disabling TPM-sealed disk encryption.

Scenario	Secureboot	vTPM	Remediation Action for VMs created from older templates and moved to below release lines
			Workstation/Fusion on 26H1	Workstation/Fusion on 25H2	Workstation/Fusion on 17.6.x
1	Disabled	Disabled	No Action	No Action	No Action
2	Enabled	Disabled	Upgrade to WS/Fusion 26H1 silently updates Platform Key	Refer to Update vmx config file section below	Refer to Manual update process on Workstation releases below
3	Enabled	Enabled	Refer to Update vmx config file section below	Refer to Update vmx config file section below	Refer to Manual update process on Workstation releases below
4	Disabled	Enabled	No Action	No Action	No Action

Update vmx config file

The .vmx file is typically located in the directory where the virtual machine is created. Add below entry to the .vmx file.

1. Back up all TPM-related application data (e.g., BitLocker recovery key), then take a VM snapshot and suspend or pause TPM application.
2. Shut down the virtual machine.
3. Add uefi.secureBoot.PK.resetOnce = "TRUE" to the .vmx file
4. Start the virtual machine.
5. From the guest OS, verify whether the Platform Key (PK) has been updated.

Manual update process on Workstation releases

1. Shutdown the virtual machine.
2. Take backup of the virtual machine files: Right click on the Virtual machine name in the Workstation Library and click on Open VM directory. Copy all the virtual machines files to another location as a backup.
3. Attach a disk containing the Microsoft Platform Key to the virtual machine (see Disk Preparation for Platform Key Update section below)
4. If the virtual machine is encrypted, ensure that any disk encryption software within the Guest OS (which may be sealed to specific TPM PCR registers) is disabled or decrypted before proceeding. Remove TPM device from the virtual machine. 
   1. Right-click on the virtual machine and select Settings.
   2. Navigate to the Hardware tab within the Virtual Machine Settings window
   3. Select Trusted Platform Module and click the Remove button..
   4. Do not confirm changes yet; instead, click on the Options tab at the top of the window.
   5. Select Access Control from the left-hand menu. Click on Remove Encryption....
   6. Wait for the encryption removal to complete. and click OK to finalize all changes.
      
      
5. Enable Secure Boot variable update without authentication by adding VMX advanced option:
   1. Right click on the Virtual machine name in the Workstation Library and click on Open VM directory. Edit virtual machine configuration file (.vmx) with notepad.
   2. Append the following line in to vmx file: uefi.allowAuthBypass = "TRUE" and save changes.
   3. Reload the virtual machine: Click x on the virtual machine tab to close it and click on the virtual machine to open it in a new tab.
      
      
      
6. Force the VM to enter Setup Mode:
   1. Right click on the Virtual machine name and click on Power > 'Power On to Firmware'.
      
      
7. Navigate to Enter Setup > Secure Boot Configuration > PK Options > Enroll PK
   1. Select the PK file from disk.
   2. Review.
   3. Commit changes and exit.
      
      
8. After the update, shutdown virtual machine and remove the vmx entry: uefi.allowAuthBypass = "TRUE".
9. Remove the disk added in Step 3 from the virtual machine and shutdown the virtual machine. Reload the virtual machine: Click x on the virtual machine tab to close it and click on the virtual machine to open it in a new tab.
10. Enable virtual machine encryption and Add TPM device to the virtual machine.
11. After completing the update and power-on the virtual machine, verify that the Platform Key is updated successfully by executing the commands below:
    
    
    • Linux:
           mokutil --pk
      
      
    • Windows:
      
      1. Open Windows PowerShell.
      2. Execute the commands below:
         $pk = Get-SecureBootUEFI -Name PK
$bytes = $pk.Bytes
$cert = $bytes[44..($bytes.Length-1)]
[IO.File]::WriteAllBytes("PK.der", $cert)
certutil -dump PK.der

Disk Preparation for Platform Key Update:

A temporary FAT32 disk is required to stage the Platform Key (PK) and related certificates for the Secure Boot update process.

Linux (Ubuntu / Debian)

1. Add and prepare a 128-MB FAT32 Disk, using following steps:
   
   
   1. 1. Add a 128-MB virtual disk to the virtual machine: Right click on the virtual machine and click on "Settings". Under 'Hardware' tab, select "Add..." button. Under 'Add Hardware Wizard' window select "Hard Disk" and click Next. Select Virtual disk type (default NVMe), click Next > select radio button for "Create a new virtual disk", click Next > Under 'Maximum disk size' box add "128", Next > provide disk file location and 'Finish'.
         1. Identify the newly added disk: lsblk
            Note: Assuming the newly added disk is detected as /dev/sdb.
            
            
         2. Format the disk as FAT32 and assign a label: sudo mkfs.vfat -F 32 -n KEYUPDATE /dev/sdb
         3. Create a mount point and mount the disk:
            
            sudo mkdir -p /mnt/keys
sudo mount /dev/sdb /mnt/keys
            
            
         4. Verify that the disk is mounted successfully: mount | grep keys


2. Download Platform Key (PK) certificate from Microsoft - Platform Key (PK) - WindowsOEMDevicesPK.der
3. Copy Certificates and Unmount the Disk.
   1. Copy the certificate files to the FAT32 disk: sudo cp WindowsOEMDevicesPK.der /mnt/keys
   2. Unmount the disk: sudo umount /mnt/keys

Windows

1. Add a 128-MB virtual disk to the virtual machine: Right click on the virtual machine and click on "Settings". Under 'Hardware' tab, select "Add..." button. Under 'Add Hardware Wizard' window select "Hard Disk" and click Next. Select Virtual disk type (default NVMe), click Next > select radio button for "Create a new virtual disk", click Next > Under 'Maximum disk size' box add "128", click Next > provide disk file location and 'Finish'.
2. Format the Disk as FAT32 by following one of the below methods:
   
   
   • GUI Method:
     
     1. Press Win + R.
     2. Type diskmgmt.msc and press Enter.
     3. Use Disk Management to format the disk as FAT32.
        
        
   • Command Line Method:
          format /FS:FAT32 X:
Note: Replace X: with the appropriate drive letter.
     
     
3. Download Platform Key (PK) Certificate from Microsoft - Platform Key (PK) - WindowsOEMDevicesPK.der
4. Copy the certificate to the newly partitioned volume with 128MB size.

Additional Information

Manual Process to Update KEK

To manually update the KEK certificate on the virtual machine, follow the instructions below:

1. Download the updated certificate from Microsoft via the link https://go.microsoft.com/fwlink/?linkid=2239775.
2. Convert the certificate to DER format using the openssl command below:
        openssl x509 -inform der -in KEK.cer -outform der -out KEK-2023.der
3. Copy the converted certificate in DER format (KEK-2023.der) to the disk mentioned in the Disk Preparation for Platform Key Update step under the Resolution section above.
4. Boot the VM into EFI setup again.
5. Update the KEK by selecting the below menu options:
   1. Secure Boot Configuration
   2. KEK Options
   3. Enroll KEK
   4. Select the file KEK-2023.der
   5. Commit Changes and Exit

Additional Issues

1. On Windows, if an error like the following is reported when applying the PK cert, try downloading the .der file again as it may have been corrupted in transport:
    Only DER encoded certificate file (*.cer/der/crt) is supported
   
   
   
   
2. Alternatively, a PEM version of the cert can be downloaded from the link https://go.microsoft.com/fwlink/?linkid=2255361 and then converted into DER format using the openssl command below:
   openssl x509 -inform der -in PK.cer -outform der -out PK.der