How to check if your Secure Boot certs are updated. (three methods)

garlin · Nov 29, 2025

Your PC meets the minimum to support booting from CA 2023.

Currently, you're missing the Microsoft UEFI CA 2023 (which can be used by Linux or other non-Windows boot loaders) and the Option ROM certs. Option ROM may be required if you have certain video cards or use the motherboard's onboard GPU.

The last BIOS update for your motherboard was released in 2020. ASUS is working with MS to check more KEK 2023 updates into the Secure Boot Objects repo, so eventually Windows might be able to apply a new KEK on your behalf.

If not, you can add it manually or use Mosby.

bikemanAMD · Nov 29, 2025

Think i'm all set as far as i know, noticed i do have KEK 2K CA 2023, along with Option Rom UEFI CA 2023. a few more bioses for my board still in beta, will apply one of those when final.

MSI Pro B650 VC Wifi Rev 1.0

garlin · Nov 29, 2025

@Ghot, please stop using AI code... :ffs:

DBCorporationUEFICertUpdated will always be false, since the correct string is "CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US". There is no "Corporation" in the CN= field.

Code:

# Define the new certificate names
$DBWindowsUEFICertSubject = "CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US"
$KEKCertSubject = "CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US"
$DBCorporationUEFICertSubject = "CN=Microsoft Corporation UEFI CA 2023, O=Microsoft Corporation, C=US"
$DBOptionROMUEFICertSubject = "CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US"

Ghot · Nov 29, 2025

garlin said:
@Ghot, please stop using AI code...

DBCorporationUEFICertUpdated will always be false, since the correct string is "CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US". There is no "Corporation" in the CN= field.

Code:

# Define the new certificate names $DBWindowsUEFICertSubject = "CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US" $KEKCertSubject = "CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US" $DBCorporationUEFICertSubject = "CN=Microsoft Corporation UEFI CA 2023, O=Microsoft Corporation, C=US" $DBOptionROMUEFICertSubject = "CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US"

I have no idea what you're talking about.
Everything I posted at the beginning of this topic, came from somewhere in this topic...

Secure boot update HowTo

i have put this together as i had problems updating 2 desktops and 3 laptops. which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert also the other post about this were getting very long and confusing. this is in two parts. part A and part B. edit by me. please...

www.elevenforum.com

It took me somewhere around 8 to 10 pages, before I even "found" the info to make this topic.

I assume you're referring to... Check-SecureBootCerts.ps1
If so, feel free to fix it and I'll update that post in this topic.
You can even "sign" it if desired.

That stuff is Hieroglyphics to me, bro. ^^

Last coding I did was in 1984 and it was Fortran.
I also know QBasic, Basic, and a bit of Visual Basic.. That's pretty much it.

garlin · Nov 29, 2025

OK, the second script you shared in Method Two has a bug. Either remove it, or repost it with the following edit:

Before:

Code:

$DBWindowsUEFICertSubject = "CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US"
$KEKCertSubject = "CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US"
$DBCorporationUEFICertSubject = "CN=Microsoft Corporation UEFI CA 2023, O=Microsoft Corporation, C=US"
$DBOptionROMUEFICertSubject = "CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US"

After:

Code:

$DBWindowsUEFICertSubject = "CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US"
$KEKCertSubject = "CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US"
$DBCorporationUEFICertSubject = "CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US"
$DBOptionROMUEFICertSubject = "CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US"

Ghot · Nov 29, 2025

garlin said:
or repost it with the following edit:

I assume we're talking about the # Define the new certificate names section?

Post #2 is edited, both script and pic are fixed.

Thanks.

garlin · Nov 29, 2025

Ghot · Nov 29, 2025

garlin said:
Yep.

I even put @garlin in the script and the post.

Any fame (money, cars, women), you accrue from this, is entirely your own fault.

I miss the line numbers in code.

fg2001gf11F · Nov 29, 2025

Ghot said:
Method Two...

1. Download the script at the bottom of this post.
2. Extract the Check-SecureBootCerts.ps1 script and place it on your desktop.
3. Go to: C:\Users\your account name\Desktop and right click Desktop and choose: Open in Terminal
4. In the powershell window that pops up, type the following...

.\Check-SecureBootCerts.ps1 and hit the ENTER key.

You should get a result similar to this...

View attachment 154845

Here is the script... credit to @garlin

Script is not signed.

Ghot · Nov 29, 2025

fg2001gf11F said:
Script is not signed.

Yeah, I had to set mine to unrestricted, too.
I added those commands to post 1 and 2.

fg2001gf11F · Nov 29, 2025

Ghot said:
Yeah, I had to set mine to unrestricted, too.
I added those commands to post 1 and 2.

I just applied the correction suggested in Post #86 to the original one that I had.
And in this case, it does not need Unrestricted ExecutionPolicy.

Dronix · Nov 30, 2025

Can anyone tell me if I interpreted the output of the results correctly?

XxXxX · Nov 30, 2025

@Dronix
your system is updated with the 2023 cert
the boot loader is using the 2023 cert

best of luck Steve ..

garlin · Nov 30, 2025

Secure Boot: ON - When Secure Boot is enabled, then cert checking is enforced for boot files. OFF -> doesn't matter what certs you have.

BitLocker on C: - BitLocker is not required for Secure Boot, but you're advised to temporarily disable BitLocker before changing UEFI certs. Otherwise you will risk a possible BitLocker recovery attempt from Windows.

KEK Certificates - Installed certs confirm other DB or DBX certs as authentic.
KEK CA 2011 signs 2011 DB or DBX certs.
KEK CA 2023 signs 2023 DB or DBX certs.
Without a KEK to confirm the matching DB or DBX certs, those certs are not enforced.

PCA 2011 is used for Windows boot loader. UEFI 2011 is for non-Windows (Linux).

[Cert for boot file] is ALLOWED on the following conditions:
- Either Secure Boot is disabled (any boot manager is allowed)
- Secure Boot is enabled AND KEK exists to sign your DB AND your boot file is signed by cert in DB AND same cert is not banned in DBX

[Windows UEFI CA 2023] is PRESENT on the following conditions:
- boot or install WIM image has been updated or released after April 2024, and has both CA 2011 and 2023 boot files in the image which will get installed on the system drive. It does not guess which version will be used, except both versions are available to copy.

UEFICA2023Status is not part of my supported script. I don't use that key because it returns less information than WindowsUEFICA2023Capable.

Since DBX (banned list) is empty, then both CA 2011 and 2023 boot files are eligible.

Where are all these bootleg versions of the script coming from?

Dronix · Nov 30, 2025

garlin said:
Where are all these bootleg versions of the script coming from?

Thanks a lot for the clarification. And this version appeared as a result of my modification of the BoScript file. the bat that I came across here on the forum. I don't pretend to be the ultimate truth, but it's more convenient for me.

fg2001gf11F · Nov 30, 2025

garlin said:
Secure Boot: ON - When Secure Boot is enabled, then cert checking is enforced for boot files. OFF -> doesn't matter what certs you have.

BitLocker on C: - BitLocker is not required for Secure Boot, but you're advised to temporarily disable BitLocker before changing UEFI certs. Otherwise you will risk a possible BitLocker recovery attempt from Windows.

KEK Certificates - Installed certs confirm other DB or DBX certs as authentic.
KEK CA 2011 signs 2011 DB or DBX certs.
KEK CA 2023 signs 2023 DB or DBX certs.
Without a KEK to confirm the matching DB or DBX certs, those certs are not enforced.

PCA 2011 is used for Windows boot loader. UEFI 2011 is for non-Windows (Linux).

[Cert for boot file] is ALLOWED on the following conditions:
- Either Secure Boot is disabled (any boot manager is allowed)
- Secure Boot is enabled AND KEK exists to sign your DB AND your boot file is signed by cert in DB AND same cert is not banned in DBX

[Windows UEFI CA 2023] is PRESENT on the following conditions:
- boot or install WIM image has been updated or released after April 2024, and has both CA 2011 and 2023 boot files in the image which will get installed on the system drive. It does not guess which version will be used, except both versions are available to copy.

UEFICA2023Status is not part of my supported script. I don't use that key because it returns less information than WindowsUEFICA2023Capable.

Since DBX (banned list) is empty, then both CA 2011 and 2023 boot files are eligible.

Where are all these bootleg versions of the script coming from?

Please specify where the original good script can be downloaded.
So many different links for downloading the scripts are quite confusing.

neldog · Nov 30, 2025

Ghot said:
I even put @garlin in the script and the post.
Any fame (money, cars, women), you accrue from this, is entirely your own fault.

I miss the line numbers in code.

It works... Thanks @garlin and @Ghot.

neldog · Nov 30, 2025

Ghot said:
Yeah, I had to set mine to unrestricted, too.
I added those commands to post 1 and 2.

User can also just check this box, and it will run. Once the box is checked once, you will not see that Security box again.

Winuser · Nov 30, 2025

garlin said:
The last BIOS update for your motherboard was released in 2020. ASUS is working with MS to check more KEK 2023 updates into the Secure Boot Objects repo, so eventually Windows might be able to apply a new KEK on your behalf.

If not, you can add it manually or use Mosby.

According to CPU-Z the BIOS is L1.34A dated 01/21/2021 and I just checked the latest BIOS on the ASRock site and it's L1.33 dated 12/04/2020. I must have used the PowerSpec site to update the BIOS. I'll check into Mosby and see if I want to use it or wait for MS. The next time I use my older PowerSpec desktop I'll check to see what Certs it's using.

gunrunnerjohn · Nov 30, 2025

garlin said:
Yep.

Well, look at that. I wondered why that was coming up false when the other checks all rang true. THANKS!

How to check if your Secure Boot certs are updated. (three methods)

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Just a Computer User

My Computers

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers