Error 1801 Telling me to update my Secure Boot CA/Keys?

Secrios · Oct 14, 2025

This came up ever since I installed the latest Windows Update today.

Should I be concerned? Should I do anything?
Anyone else getting this?

garlin · Oct 14, 2025

This is an informational warning. You have the latest BIOS firmware (v1901) for the X570-Creator WiFi. At some point next year, Windows will force a revocation of the CA 2011 certs. But it's not required at this time.

antspants · Oct 14, 2025

I don’t understand why people visit the Event Viewer. The only time I have ever seen it was to work out how to instruct a member on how to use it. It causes mayhem, panic, there’s always blood and someone dies in the end.

gunrunnerjohn · Oct 14, 2025

garlin said:
This is an informational warning. You have the latest BIOS firmware (v1901) for the X570-Creator WiFi. At some point next year, Windows will force a revocation of the CA 2011 certs. But it's not required at this time.

The crime is they mark stuff like this as an error, not a warning or an informational message!

garlin · Oct 14, 2025

gunrunnerjohn said:
The crime is they mark stuff like this as an error, not a warning or an informational message!

If Windows logs Event 1801/TPM-WMI as a Warning now, and then it's changed to Error – someone who's filtering on event logs is going to miss the switch.

Secrios · Oct 14, 2025

garlin said:
This is an informational warning. You have the latest BIOS firmware (v1901) for the X570-Creator WiFi. At some point next year, Windows will force a revocation of the CA 2011 certs. But it's not required at this time.

How was you able to deduce this is only informational?

garlin · Oct 14, 2025

If you have not been following along, MS has been trying to inform users of the upcoming Secure Boot migration which is underway. The messaging will be more common and visible in the upcoming months.

As a two part problem, the existing CA 2011 Secure Boot signing certs have been abused to sign UEFI rootkit malware and will eventually expire anyway in 2026. MS needs to simultaneously ban the use of CA 2011-signed boot code, and get your UEFI to trust CA 2023 signing certs for the next generation of Windows boot files.

At this stage of the process, they're encouraging users to download the latest UEFI firmware whenever possible. Your motherboard has the latest (per ASUS's website). This should add the CA 2023 signing certs to be in parallel with CA 2011.

The next step is to revoke the CA 2011 certs. Currently in the migration plan, it's optional and early adopters can do this. If you don't do anything, MS will take more active steps next year to finish the update process.

There's three ElevenForum threads going on (in parallel) about the Secure Boot migration process. If you feel that you need to take action now to prevent your PC from being exposed to Black Lotus UEFI malware, then you can revoke the CA 2011 certs today. But that also requires you to update the boot files on any Windows install ISO or boot USB media you're using.

Did you manually update your Secure Boot Keys ?

Hi. Current Microsoft Secure Boot Keys will expire in 2026. Therefore, it may be advisable to update the keys manually in advance. I did the update and it was successful. If you have bitlocker enabled, you are advised to save your bitlocker keys. You will need them after the secure boot key...

www.elevenforum.com

Updating Microsoft Secure Boot keys before expiration in June 2026

https://support.microsoft.com/en-us/topic/if-you-re-prevented-from-updating-secure-boot-certificates-e01cc486-8721-457f-9bc7-5cb801c1759e UPDATE 4/02: https://support.microsoft.com/en-us/topic/secure-boot-certificate-update-status-in-the-windows-security-app-5ce39986-7dd2-4852-8c21-ef30dd04f046...

www.elevenforum.com

Act now: Secure Boot certificates expire in June 2026

UPDATE: https://www.elevenforum.com/t/updating-microsoft-secure-boot-keys-before-expiration-in-june-2026.22477/ Windows IT Pro Blog: Prepare for the first global large-scale certificate update to Secure Boot. The Microsoft certificates used in Secure Boot are the basis of trust for operating...

www.elevenforum.com

Margarita · Oct 14, 2025

No problem with secure boot and revocation of old certificates "CA 2011".

Margarita · Oct 14, 2025

@garlin
I now have a new BIOS update. What does the text in the red box mean? Is it related to updating the secure boot keys?

Try3 · Oct 14, 2025

antspants said:
I don’t understand why people visit the Event Viewer

I agree with you.

EventViewer was not designed to assist the user [judging by its interface] and its provenance has never been explained.
There is no documentation to tell us whether an error event is temporary [to act as an internal trigger for a repeat operation for which successful completion is not recorded] or not.

It can be very useful when investigating [real] fault symptoms but I never regard an entry in Event vwr to be sufficient reason to initiate a fault investigation.
I have quite a few Custom views set up ready for the things I look in Event vwr most frequently [but several of them have never proved to be useful].

Denis

garlin · Oct 14, 2025

Margarita said:
@garlin
I now have a new BIOS update. What does the text in the red box mean? Is it related to updating the secure boot keys?

No. Those are UEFI features unrelated to Secure Boot.

Pre-boot DMA prevents other UEFI-level devices (that have a smart onboard controller) from snooping UEFI's memory. VT-d and IOMMU are HW features that speed up virtualization when Window enables Core Integrity.

Try3 · Oct 14, 2025

It's a small world, isn't it. Just after reading this thread, I stumbled across a similar one.

Try3 said:
I see lots of 1796 EventIDs.
Mine are all annotated with the fact that Secure boot is currently disabled on my computer.

What evidence have you got that there is anything to be fixed?
I have studied this thread and there is nothing to indicate that any response is required at all.

Event viewer was not designed for our benefit and there is no documentation to explain its various entries.
I firmly believe that Event viewer can be a useful tool in investigating faults that have [operational] symptoms but the existence or otherwise of an entry in Event viewer is not sufficient reason to launch a fault investigation let alone take any action.

All the best,
Denis

Margarita · Oct 15, 2025

garlin said:
No. Those are UEFI features unrelated to Secure Boot.

Pre-boot DMA prevents other UEFI-level devices (that have a smart onboard controller) from snooping UEFI's memory. VT-d and IOMMU are HW features that speed up virtualization when Window enables Core Integrity.

Ok, thank you, BIOS has been successfully updated.

gunrunnerjohn · Oct 15, 2025

garlin said:
There's three ElevenForum threads going on (in parallel) about the Secure Boot migration process. If you feel that you need to take action now to prevent your PC from being exposed to Black Lotus UEFI malware, then you can revoke the CA 2011 certs today. But that also requires you to update the boot files on any Windows install ISO or boot USB media you're using.

And some nice guy conveniently provided a simple batch file to update the boot files on USB boot disks.

Secrios · Oct 15, 2025

Will Microsoft see to it these certificates will be resolved painlessly with their own updates?

garlin · Oct 15, 2025

The general answer is yes. Especially since you have an up-to-date BIOS. Other users with older PC's that haven't received BIOS updates to address the Secure Boot issue will have problems that need to be solved manually.

khaledkhan_0127 · Oct 29, 2025

Hi everyone.

Need some help this below error message is from the VM on Hyper V. Please help me with this
I got the same TPM- wmi error but my log message is this -

Secure Boot CA/keys need to be updated. This device signature information is included here.
DeviceAttributes:
Bucketid:
BucketConfidenceLevel:
UpdateType: 0
HResult: The system cannot find the file specified.

garlin · Oct 29, 2025

Your Hyper-V will report the same 1801 errors as the physical host, because they both read from the same UEFI.

Follow the MS instructions to update the Secure Boot certs:
How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932

Winback · Oct 31, 2025

Same error here this morning.

However, I have the latest version of the motherboard BIOS. There is no newer version on the Asus website.

At the end of the message in the details, it says “the operation was successful,” which contradicts the event classified as an error.

Does that mean everything is fine and that a future Windows update will fix this ?

Buddywh · Oct 31, 2025

Windplay87 said:
Same error here this morning.

Make sure Diagnostics Reporting is enabled, and that your Windows system is starting up in Secure Boot mode. Microsoft will push out updated keys in the next few weeks or months using a phased and scheduled roll-out.

You don't need the updates now, and won't need them until Microsoft concludes revoking trust in the 2011 keys and commences allowing only 2023 signed boot managers to start Windows in Secure Boot, probably not before mid-year next but it may happen for some earlier since this IS a gradual and phased roll out.

OR... read through the below thread to get ideas how to manually update them ahead of time.

If you don't use Secure Boot now and never intend to then just ignore the whole thing.

Did you manually update your Secure Boot Keys ?

Hi. Current Microsoft Secure Boot Keys will expire in 2026. Therefore, it may be advisable to update the keys manually in advance. I did the update and it was successful. If you have bitlocker enabled, you are advised to save your bitlocker keys. You will need them after the secure boot key...

www.elevenforum.com

Error 1801 Telling me to update my Secure Boot CA/Keys?

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers