[Help] [SOLVED]

[Bungles]

will terramaster be rolled out secure boot CA2023 certificates, i am using f2 423 tos 5.1.45

TIA
davie

[MikeZhang]

Dear Davie, in what scenarios do you use Secure Boot? We'd like to know why you need CA2023 certificates.

[yokurt]

Dear Davie, in what scenarios do you use Secure Boot? We'd like to know why you need CA2023 certificates.

Hi MikeZhang, adding to Bungles’ question — same concern on an F2-423, but running Debian (not TOS). Secure Boot is enabled and working today.

Why CA 2023 is needed

Microsoft’s UEFI CA 2011 (and related 2011 Secure Boot certs) expire in 2026. Firmware that only trusts the 2011 CA will keep booting today’s signed loaders, but once OS vendors ship bootloaders signed only with the 2023 CA, systems whose firmware db never received the 2023 certificate will fail Secure Boot until SB is disabled.

This is not a special use case — it affects any F2-423 with Secure Boot enabled: TOS, Debian, Ubuntu, Proxmox, etc., as long as they use the standard Microsoft-signed shim path.

My F2-423 — measured data

• BIOS: AMI 5.19, release date 2022-05-29
• Secure Boot: enabled
• Firmware db (via efi-readvar): Microsoft UEFI CA 2011 present — no Microsoft UEFI CA 2023
• Debian shimx64.efi: dual-signed (2011 + 2023) — boots today via the 2011 signature only

Questions

1. Will TerraMaster release an F2-423 BIOS/firmware update that adds Microsoft UEFI CA 2023 to Secure Boot db (and updated KEK if needed)?
2. If yes — which package/version (e.g. Bios_T1509BG0 or newer) and where are the release notes?
3. If no — is that a permanent limitation for 223/423 series, and what is TerraMaster’s recommended approach before 2023-only signed bootloaders appear?

I'm not blocked today (disabling Secure Boot is a workaround), but many users on F2-423 hardware will hit this on routine OS updates unless firmware is updated.

Thanks.

[crisisacting]

Will second all your inquiries, as these TNAS models are not listed as end-of-life yet, so there should be some expectation of relevant updates to the product(s).

If possible, the hopefully forthcoming update should contain both 2011 & 2023 CAs for the widest compatibility.

[TMjack]

Regarding CA certificates, users can import new certificates through the UEFI Setup graphical interface. The steps are as follows:

Enter BIOS/UEFI Setup (usually by pressing Del / F2)
Navigate to Secure Boot → Key Management or a similar menu
Select Authorized Signatures (db) → Append / Import
Choose the Microsoft UEFI CA 2023. der or .esl file from a FAT32-formatted USB drive
Confirm the import, then save and exit

[yokurt]

Regarding CA certificates, users can import new certificates through the UEFI Setup graphical interface. The steps are as follows:

Enter BIOS/UEFI Setup (usually by pressing Del / F2)
Navigate to Secure Boot → Key Management or a similar menu
Select Authorized Signatures (db) → Append / Import
Choose the Microsoft UEFI CA 2023. der or .esl file from a FAT32-formatted USB drive
Confirm the import, then save and exit

Thanks for the info. I got the certificate imported. Some more details that worked for me:
* I downloaded the Microsoft UEFI CA 2023 from Microsoft page. crt-file on USB stick worked
* Security -> Secure Boot Mode: I had to change to Custom to be able to choose Key Management
* Authorized Signatures -> Append -> Public Key Certificate
Now I get both listed:

Code: Select all

sudo efi-readvar -v db | grep -i "UEFI CA"
            C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011
            C=US, O=Microsoft Corporation, CN=Microsoft UEFI CA 2023