[Windows] v1.26.31: VeraCrypt Setup warning

Open
  • Is something wrong?
#1,989 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
c
Domain
security

Research direction

Start by locating the Setup.exe code that displays the Windows Boot Manager certificate warning; the issue does not name a source file or test. Trace what the warning means for an offline upgrade from VeraCrypt 1.26.29 to 1.26.31 on Windows 10 1909, and identify the steps the user should take. Done means the user receives accurate, actionable guidance for this scenario.

Written by the indexing model from the issue text.

Description

bug

Expected behavior

No error

Observed behavior

I tried upgrading VC 1.26.29 on OFFLINE FullyEncrypted Win10 Version 1909 and here's what I got:

---------------------------
VeraCrypt Setup
---------------------------
Warning: The embedded signature of the Windows Boot Manager used by VeraCrypt (bootmgfw_ms.vc) is still issued by Microsoft Windows Production PCA 2011, although firmware db already contains Windows UEFI CA 2023. Its known CA is currently allowed, but it will no longer start after the PCA 2011 certificate is added to dbx.

Do not apply the PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280) yet. First complete the Windows 2023 boot-manager update while the VeraCrypt System Favorites service is enabled, then run VeraCrypt Repair/Reinstall so VeraCrypt can import a compatible serviced EFI_EX/EFI copy. Verify the embedded issuer of bootmgfw_ms.vc is Windows UEFI CA 2023 and make sure you have an up-to-date VeraCrypt Rescue Disk.

This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation.
---------------------------
OK   
---------------------------

What exactly do I need to do?

Connecting to the internet is not allowed so I need to download something from internet on other PC.

Steps to reproduce

  1. Select "Repair/Reinstall" on Setup.exe

Screenshots

Your Environment

Please tell us more about your environment

VeraCrypt version: 1.26.29 -> 1.26.31

Operating system and version: Win10 1909

System type: 64bit

Dominant language
C
Stars
11.7k
Forks
1.4k
Avg merge
1d 1h
Merged PRs (30d)
28

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from veracrypt/VeraCrypt

All issues in veracrypt/VeraCrypt

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.