Solved Acer Predator Helios 300 PH317-56 Secure Boot Certificate Update.

acer54 said:

My secure boot certificates etc. still have not been updated, has anybody with the same laptop had them updated by either Acer and/or Microsoft or any other method successfully?

Click to expand...

Secure boot update HowTo

i have put this together as i had problems updating 2 desktops and 3 laptops. which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert also the other post about this were getting very long and confusing. this is in two parts. part A and part B. edit by me. please...

www.elevenforum.com

FreeBooter said:

Windows Secure Boot certificates (such as the 2023 CA keys replacing aging 2011 certificates) are primarily delivered automatically via standard Windows Update. Most users do not need manual intervention, but you can verify your status or force-trigger updates if needed.

Click to expand...

FreeBooter said:

How is everything progressing, do you need more assistant on this issue?

Click to expand...

Step 1: Check Your Current Status​

1. Open Windows Security via the Start menu.
2. Click Device security.
3. Look at the Secure boot section:
   • Up to date: "Secure boot is on and all required certificate updates have been applied." You do not need to do anything further.
   • Action needed: It indicates certificate updates are required or blocked.

Step 2: Verify Active Certificates via PowerShell​

1. Right-click Start and select Terminal (Admin) or PowerShell (Admin).
2. Run the following commands:

• If both output True, the 2023 certificates are active.
• If either outputs False, the certificates still need to be updated or applied.

Step 3: Update and Apply the Certificates​

Method A: Automatic Deployment (Recommended)​

1. Go to Settings > Windows Update.
2. Select Check for updates and install all cumulative and security updates.
3. Restart your PC. Microsoft automatically deploys and applies the DB/KEK updates to most consumer systems via standard monthly updates.

Method B: Force Manual Servicing (For Early Deployment)​

1. Open PowerShell (Admin).
2. Set the registry key to apply the update on the next reboot:

1. Restart your PC twice to complete the enrollment phase.

Method C: Update Hardware Firmware / BIOS (If Blocked)​

• Update your BIOS: Check your motherboard or laptop manufacturer's support site (Dell, Lenovo, ASUS, MSI, HP, etc.) for the latest BIOS/UEFI firmware update that includes the updated Windows UEFI CA 2023 database.
• BitLocker Caution: If BitLocker drive encryption is enabled, ensure you back up your BitLocker Recovery Key before running any BIOS update.

FreeBooter said:

Microsoft's original Secure Boot certificates (issued in 2011) expire in 2026, requiring systems to update to the newer 2023 Secure Boot certificates (e.g., Windows UEFI CA 2023).

Step 1: Check Your Current Status​

1. Open Windows Security via the Start menu.
2. Click Device security.
3. Look at the Secure bootsection:
   • Up to date: "Secure boot is on and all required certificate updates have been applied." You do not need to do anything further.
   • Action needed: It indicates certificate updates are required or blocked.

Step 2: Verify Active Certificates via PowerShell​

To manually check if the 2023 certificates are active on your system:

1. Right-click Start and select Terminal (Admin) or PowerShell (Admin).
2. Run the following commands:

PowerShell

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI KEK).bytes) -match 'Microsoft Corporation KEK 2K CA 2023'

PowerShell

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

• If both output True, the 2023 certificates are active.
• If either outputs False, the certificates still need to be updated or applied.

Step 3: Update and Apply the Certificates​

Method A: Automatic Deployment (Recommended)​

1. Go to Settings > Windows Update.
2. Select Check for updates and install all cumulative and security updates.
3. Restart your PC. Microsoft automatically deploys and applies the DB/KEK updates to most consumer systems via standard monthly updates.

Method B: Force Manual Servicing (For Early Deployment)​

If Windows Update is fully installed but PowerShell still returns False, trigger the certificate application flag via Registry/PowerShell:

1. Open PowerShell (Admin).
2. Set the registry key to apply the update on the next reboot:

PowerShell

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0x40 -Type DWord

1. Restart your PC twice to complete the enrollment phase.

Method C: Update Hardware Firmware / BIOS (If Blocked)​

If Windows Security shows a message stating that updates are blocked or firmware is incompatible:

• Update your BIOS: Check your motherboard or laptop manufacturer's support site (Dell, Lenovo, ASUS, MSI, HP, etc.) for the latest BIOS/UEFI firmware update that includes the updated Windows UEFI CA 2023 database.
• BitLocker Caution: If BitLocker drive encryption is enabled, ensure you back up your BitLocker Recovery Key before running any BIOS update.

Click to expand...