platform key

The platform key (PK) is the root of trust in UEFI Secure Boot, establishing a chain of trust from firmware to the operating system. Discussions on WindowsForum.com cover Microsoft's guidance for OEMs and ODMs on Secure Boot key creation and management, including recommended key types, sizes, and lifecycle controls. A key topic is the Microsoft KEK CA rollover, which replaces legacy 2011 trust anchors with new 2023 CA families. Administrators must prepare for this transition to avoid pre-boot update failures or devices rejecting legitimately signed boot components. The platform key, along with the Key Exchange Key (KEK) and signature databases (db and dbx), determines which boot components are trusted. Proper management of the platform key is critical for maintaining device security and compliance with Microsoft's evolving Secure Boot requirements.