Error 1801 Telling me to update my Secure Boot CA/Keys?

Buddywh · Nov 12, 2025

Olax said:
I will need to update bios?

If there is a later rev. I'd update it, especially if a fairly recent one.

Olax · Nov 13, 2025

Buddywh said:
If there is a later rev. I'd update it, especially if a fairly recent one.

If i wont do it, then certificates will not be updated?

Buddywh · Nov 13, 2025

Olax said:
If i wont do it, then certificates will not be updated?

They will still be pushed into firmware even if you don't update BIOS. You should leave it in Secure Boot mode, enable diagnostic reporting and stay current with updates to allow Microsoft to do so.

But if you update BIOS they then become the default "built-in" keys.

Olax · Nov 13, 2025

Buddywh said:
They will still be pushed into firmware even if you don't update BIOS. You should leave it in Secure Boot mode, enable diagnostic reporting and stay current with updates to allow Microsoft to do so.

But if you update BIOS they then become the default "built-in" keys.

How to enable diagnostic reporting?

Buddywh · Nov 13, 2025

Olax said:
How to enable diagnostic reporting?

Open Windows Settings, then Privacy and Security, then Diagnostics and Feedback.

At least that's where I find it on my Win11 Pro, 25h2.

There is apparently some measure of reporting by default, so this piece of advice from Microsoft may be targeted more to people who've used third party apps, registry hacks or Group Policy editor settings to completely turn off all diagnostics reporting. I turned on Optional reporting just to be sure.

Except I also went ahead and updated the keys using MOSBY

Olax · Nov 13, 2025

Buddywh said:
Open Windows Settings, then Privacy and Security, then Diagnostics and Feedback.

At least that's where I find it on my Win11 Pro, 25h2.

There is apparently some measure of reporting by default, so this piece of advice from Microsoft may be targeted more to people who've used third party apps, registry hacks or Group Policy editor settings to completely turn off all diagnostics reporting. I turned on Optional reporting just to be sure.

Except I also went ahead and updated the keys using MOSBY

I need to enable the optional?

Olax · Nov 13, 2025

Olax said:
I need to enable the optional? And leave secure boot enabled right? And dont update the BIOS.

Buddywh · Nov 13, 2025

Olax said:
And dont update the BIOS

Updating BIOS usually has many benefits.

Olax · Nov 14, 2025

Buddywh said:
Updating BIOS usually has many benefitswhich?

Buddywh said:

Updating BIOS usually has many benefits.

Click to expand...

which benefits? And i need to update it to get the new keys/certificates?

Buddywh · Nov 14, 2025

Improved system stability and compatibility, mitigated security threats are common benefits.

go back and read

Olax · Nov 14, 2025

Buddywh said:
Improved system stability and compatibility, mitigated security threats are common benefits.

go back and Reading

Buddywh said:
Improved system stability and compatibility, mitigated security threats are common benefits.

go back and read

So i need to update bios when is everything fine now?

Scannerman · Nov 14, 2025

antspants said:
I don’t understand why people visit the Event Viewer. The only time I have ever seen it was to work out how to instruct a member on how to use it. It causes mayhem, panic, there’s always blood and someone dies in the end.

Event Viewer errors are as prevalent carbon dioxide. The Viewer can be annoying but it's useful to have. Obsessing over it is a waste of time. Only when there are serious issues, BSODs, catastrophic system failures, etc. is it worth looking into. All systems generate errors to a greater or lesser extent. Most of them are negligible as the system will usually sort itself out. Anyway, that has been my finding.

hdmi · Nov 16, 2025

Buddywh said:
They will still be pushed into firmware even if you don't update BIOS. You should leave it in Secure Boot mode, enable diagnostic reporting and stay current with updates to allow Microsoft to do so.

But if you update BIOS they then become the default "built-in" keys.

AFAIK disabling diagnostic reporting or disabling telemetry (or both) doesn't prevent Windows Update from pushing them into firmware. Disabling Secure Boot does prevent, but the dbx capsule still gets staged in a special EFI variable (EFI_UPDATE_CAPSULE) in NVRAM/flash where either:

it will stay staged until you boot with Secure Boot enabled or
it will stay staged until it is discarded/replaced with another, newer dbx capsule that supersedes it (e.g. if the capsule from KB5012170 still sits in there staged when the new one will be staged).

In a nutshell, Windows Update downloads and installs the update the successful installation of which causes the dbx capsule to be staged, and, after that, booting with Secure Boot enabled causes the staged dbx capsule to be pushed into firmware.

Buddywh · Nov 16, 2025

hdmi said:
AFAIK disabling diagnostic reporting or disabling telemetry (or both) doesn't prevent Windows Update from pushing them into firmware. Disabling Secure Boot does prevent, but the dbx capsule still gets staged in a special EFI variable (EFI_UPDATE_CAPSULE) in NVRAM/flash where either:

it will stay staged until you boot with Secure Boot enabled or

it will stay staged until it is discarded/replaced with another, newer dbx capsule that supersedes it (e.g. if the capsule from KB5012170 still sits in there staged when the new one will be staged).

In a nutshell, Windows Update downloads and installs the update the successful installation of which causes the dbx capsule to be staged, and, after that, booting with Secure Boot enabled causes the staged dbx capsule to be pushed into firmware.

Microsoft makes a point of enabling diagnostic reporting in their documents. I think they might use the diagnostics data to determine the precise motherboard model, rev. and BIOS revision that's installed, among whatever else is needed. That way the routine can pick (or perhaps get prepared) the correct OEM-signed KEK for pushing into BIOS. If that's correct, without the data it won't update KEK.

And of course it also won't update KEK if an OEM hasn't provided a signed one for that model/rev, hence they may send out requests to OEM's for ones they don't have.

I may be wrong, but it does make sense. Also, if you go check the Secure Boot Update registry key there's quite a bit of that data there. If it's considered protected data they may need permission to send it back.

Olax · Nov 17, 2025

hdmi said:
AFAIK disabling diagnostic reporting or disabling telemetry (or both) doesn't prevent Windows Update from pushing them into firmware. Disabling Secure Boot does prevent, but the dbx capsule still gets staged in a special EFI variable (EFI_UPDATE_CAPSULE) in NVRAM/flash where either:

it will stay staged until you boot with Secure Boot enabled or

it will stay staged until it is discarded/replaced with another, newer dbx capsule that supersedes it (e.g. if the capsule from KB5012170 still sits in there staged when the new one will be staged).

In a nutshell, Windows Update downloads and installs the update the successful installation of which causes the dbx capsule to be staged, and, after that, booting with Secure Boot enabled causes the staged dbx capsule to be pushed into firmware.

When Will be the update? I have secure boot on and diagnostics reporting on requied and newest Windows version. The have even my friend on the Same board as mine and he have the newest bios and still the error is here.

XxXxX · Nov 17, 2025

Olax said:
When Will be the update? I have secure boot on and diagnostics reporting on requied and newest Windows version. The have even my friend on the Same board as mine and he have the newest bios and still the error is here.

please have a look at this post it maybe of help.

Secure boot update HowTo

i have put this together as i had problems updating 2 desktops and 3 laptops. which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert also the other post about this were getting very long and confusing. this is in two parts. part A and part B. edit by me. please...

www.elevenforum.com

best of luck Steve ..

Buddywh · Nov 17, 2025

Olax said:
When Will be the update? I have secure boot on and diagnostics reporting on requied and newest Windows version. The have even my friend on the Same board as mine and he have the newest bios and still the error is here.

Act now: Secure Boot certificates expire in June 2026 - Windows IT Pro Blog

Get tips to prepare for the rollout of updated certificates across your organization.

techcommunity.microsoft.com

The best thing to do is see if your system has a firmware update available. Microsoft will be rolling out updates all the way up to June of 2026... maybe even October of 2026, not everyone all at once.

hdmi · Nov 18, 2025

@Buddywh

What the KEK is

The Key Exchange Key (KEK) database in UEFI Secure Boot is a list of public keys authorized to update the Secure Boot databases (db, dbx).
Microsoft’s KEK entry is one of them, pre‑installed by OEMs in nearly all Windows‑certified machines.
The KEK is what allows Microsoft‑signed capsules (like dbx updates) to be accepted and applied by firmware.

How dbx updates work vs. KEK updates

dbx updates:
- Delivered as capsules signed with Microsoft’s KEK private key.
- Firmware validates the signature against the KEK already stored in NVRAM.
- If valid, the dbx database is updated.
KEK updates:
- Much rarer. Updating the KEK itself means replacing or adding trusted keys in the KEK database.
- This requires a capsule signed by a key already in KEK or by the Platform Key (PK).
- Microsoft only issues KEK updates if the existing KEK is compromised or needs rotation.

How Microsoft knows what to include

Microsoft maintains the authoritative KEK entry for Windows‑certified platforms.
OEMs ship firmware with Microsoft’s KEK pre‑installed (alongside OEM KEKs).
When Microsoft decides to update the KEK (e.g., rotate to a new certificate), they generate a capsule containing the new KEK entry.
That capsule is signed by the current valid KEK or PK, so firmware can authenticate it.
The data included is deterministic: the new KEK certificate itself, plus metadata (version, GUID) so firmware knows how to replace or append.

Lifecycle of a KEK update

Microsoft issues new KEK certificate (e.g., new RSA/ECC keypair).
Capsule created containing the new KEK entry.
Capsule signed with the existing KEK private key (or PK).
Windows Update delivers capsule to client systems.
Firmware validates capsule against current KEK/PK.
Firmware updates KEK database in NVRAM.
Future db/dbx updates are signed with the new KEK.

Microsoft doesn’t use diagnostics reporting or anything to figure out what KEK data to include—they author the KEK entry themselves. OEMs ship it, firmware trusts it, and when rotation is needed, Microsoft publishes a capsule containing the new KEK certificate signed by the old one (or PK). That’s how the chain of trust is preserved.

Buddywh · Nov 18, 2025

hdmi said:
That capsule is signed by the current valid KEK or PK, so firmware can authenticate it.

I'm not sure that's correct... at least everything I've read says a KEK must be signed by the machine's PK and nothing else will do to maintain the Root of Trust. Reference: UEFI Specification, (Version 2.1 and earlier), Section 32.3.1.

So this is why Microsoft prepares the KEK (as you say) but then sends them to the OEM's to sign with the PK's for each of their devices, who should then return them to be included in the updates. They did this many months ago but many of the OEM's have been very slow to return them, which is one reason Microsoft is rather far behind their original plans to roll these updates out. At least, this is the rather consistent story being told in most authoritative articles I've been reading.

You can get the KEK secure boot objects from MIcrosoft's GitHUB . There you can find both SIGNED (ordered by Mfr/OEM) KEK objects... and as well an unsigned KEK which a user can sign with their own PK. They can be directly appended to a device's secure boot variables... assuming it's BIOS includes the controls for doing so. And some may be able to append an unsigned KEK as a PUBLIC key which uses the device's PK to sign it first; or so I'm told at least.

hader · Nov 18, 2025

I had that TPM error also. It's not the BIOS that needs to be updated. You have to implement CA2023.
Just download this .zip file; https://mega.nz/file/9MVjGLRK#NxCNK-QP4V1aJuDT6Td3u0cfj4AioVogl6CK2F2UF8Q (contains some small .bat files) and follow the instructions:

Check Windows UEFI CA 2023 Update Status/Capable : Right click on "Check.cmd" > Run as administrator
Windows UEFI CA 2023 Update Status :

NotStarted – The update has not yet run.
InProgress – The update is actively in progress.
Updated – The update has completed successfully.

Windows UEFI CA 2023 Update Capable :

0x0 – Windows UEFI CA 2023 certificate is not in the DB (or key does not exist).
0x1 – Windows UEFI CA 2023 certificate is in the DB.
0x2 – Windows UEFI CA 2023 certificate is in the DB and the system is starting from the 2023 signed boot manager.

Update Windows UEFI CA 2023 :

- Right click on "1-Setup.cmd" > Run as administrator > Close the command prompt window
- Right click on "2-Update.cmd" > Run as administrator > Close the command prompt window
- Right click on "Check.cmd" > Run as administrator > Check that Windows UEFI CA 2023 Update Status is InProgress > Close the command prompt window > Wait 5 minutes then restart your PC
- Right click on "Check.cmd" > Run as administrator > Check that Windows UEFI CA 2023 Update Status is InProgress > Close the command prompt window > Wait 5 minutes then restart your PC
- Right click on "Check.cmd" > Run as administrator :

- If the Windows UEFI CA 2023 Update Status is still InProgress : Right click on "2-Update.cmd" > Run as administrator > Close the command prompt window > Wait 5 minutes then restart your PC (redo as much as necessary)
- If the Windows UEFI CA 2023 Update Status is Updated and the Windows UEFI CA 2023 Update Capable is 0x2 : Right click on "3-Cleanup.cmd" > Run as administrator > Close the command prompt window > Done.

Error 1801 Telling me to update my Secure Boot CA/Keys?

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

New member

My Computer

New member

My Computer

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

New member

My Computer

Well-known member

My Computer

Jack of all trades – master of none

My Computers

Well-known member

My Computers

New member

My Computer

Just a Computer User

My Computers

Well-known member

My Computers

Jack of all trades – master of none

What the KEK is​

How dbx updates work vs. KEK updates​

How Microsoft knows what to include​

Lifecycle of a KEK update​

My Computers

Well-known member

My Computers

Well-known member

My Computer

Similar threads

What the KEK is

How dbx updates work vs. KEK updates

How Microsoft knows what to include

Lifecycle of a KEK update