WindowsセキュアブートCA証明書の期限切れ（2026年6月）とEC2への影響について調査してみた（続編）

aws ec2 describe-instances \
  --filters "Name=platform,Values=windows" \
  --query 'Reservations[].Instances[].[InstanceId, BootMode, State.Name]' \
  --output table \
  --region ap-northeast-1

# セキュアブートの有効状態を確認
Confirm-SecureBootUEFI

# UEFI証明書（KEK / DB）の中身を取得
Get-SecureBootUEFI -Name KEK
Get-SecureBootUEFI -Name db

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$ErrorActionPreference = 'Continue'

Write-Host '===== OS BUILD ====='
Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber, WindowsProductName | Format-List

Write-Host '===== HOTFIX (KB5025885 / KB5012170) ====='
Get-HotFix -Id KB5025885, KB5012170 -ErrorAction SilentlyContinue | Select-Object HotFixID, InstalledOn | Format-Table -AutoSize

Write-Host '===== SECURE BOOT STATUS ====='
try { $sb = Confirm-SecureBootUEFI; Write-Host "SecureBoot Enabled: $sb" } catch { Write-Host "SecureBoot check failed: $_" }

Write-Host '===== KEK certificates ====='
try {
  $kek = Get-SecureBootUEFI -Name KEK
  $kekText = [System.Text.Encoding]::ASCII.GetString($kek.Bytes)
  ($kekText -split [char]0) | Where-Object { $_ -match 'Microsoft|2011|2023|Corporation' } | Select-Object -Unique
} catch { Write-Host "KEK read failed: $_" }

Write-Host '===== DB certificates ====='
try {
  $db = Get-SecureBootUEFI -Name db
  $dbText = [System.Text.Encoding]::ASCII.GetString($db.Bytes)
  ($dbText -split [char]0) | Where-Object { $_ -match 'Microsoft|2011|2023|Corporation' } | Select-Object -Unique
} catch { Write-Host "DB read failed: $_" }

aws ssm send-command \
  --region ap-northeast-1 \
  --document-name "AWS-RunPowerShellScript" \
  --comment "SecureBoot check" \
  --instance-ids i-xxxxxxxxxxxxxxxxx i-yyyyyyyyyyyyyyyyy \
  --parameters file://params.json \
  --query 'Command.CommandId' \
  --output text

aws ssm get-command-invocation \
  --region ap-northeast-1 \
  --command-id <CommandId> \
  --instance-id i-xxxxxxxxxxxxxxxxx \
  --query 'StandardOutputContent' \
  --output text

===== OS BUILD =====
OsName             : Microsoft Windows Server 2019 Datacenter
OsVersion          : 10.0.17763
OsBuildNumber      : 17763
WindowsProductName : Windows Server 2019 Datacenter

===== HOTFIX (KB5025885 / KB5012170) =====
（出力なし → 該当KB未適用）

===== SECURE BOOT STATUS =====
SecureBoot Enabled: False

===== KEK certificates =====
KEK read failed: Variable is currently undefined: 0xC0000100

===== DB certificates =====
DB read failed: Variable is currently undefined: 0xC0000100

===== OS BUILD =====
OsName             : Microsoft Windows Server 2025 Datacenter
OsVersion          : 10.0.26100
OsBuildNumber      : 26100
WindowsProductName : Windows Server 2025 Datacenter

===== SECURE BOOT STATUS =====
SecureBoot Enabled: False

===== KEK certificates =====
KEK read failed: 変数は現在定義されていません: 0xC0000100

===== DB certificates =====
DB read failed: 変数は現在定義されていません: 0xC0000100

===== KEK certificates =====
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK CA 2023

===== DB certificates =====
Microsoft Windows Production PCA 2011
Microsoft UEFI CA 2011
Microsoft UEFI CA 2023