Solved Secure boot update HowTo

badger52 · Nov 25, 2025

Hello - I followed the directions perfectly (hopefully), but status is showing "InProgress". Is there something I need to do to finish this process?

Screenshot (6).png

drive.google.com

UPDATE: After another RESTART, am finally showing UPDATED! Thank You!!!

fg2001gf11F · Nov 25, 2025

badger52 said:
Hello - I followed the directions perfectly (hopefully), but status is showing "InProgress". Is there something I need to do to finish this process?

Screenshot (6).png

drive.google.com

UPDATE: After another RESTART, am finally showing UPDATED! Thank You!!!

You show this error; you may search for the error code on the web. Good luck!

Hazel123 · Nov 25, 2025

Dirtyflash said:
I found this on a MS FAQ, though it made for interesting reading:

Frequently asked questions about the Secure Boot update process - Microsoft Support

support.microsoft.com

View attachment 154166

On that list

So what exactly will that mean? Insecurity? No further security updates for secure boot?

badger52 · Nov 25, 2025

fg2001gf11F said:
You show this error; you may search for the error code on the web. Good luck!

View attachment 154277

Hi there - Yes, though the ERROR disappeared when it finally finished updating! Thanks for noticing!

Dirtyflash · Nov 25, 2025

Hazel123 said:
On that list

View attachment 154310

So what exactly will that mean? Insecurity? No further security updates for secure boot?

Depending on who you ask, it could be a curse, or a blessing. It seems to be a common developing myth that devices will not be able to boot once the certificates expire, just look at all the threads and posts in this forum.

Marcus Vinicus · Nov 25, 2025

Dirtyflash said:
Depending on who you ask, it could be a curse, or a blessing. It seems to be a common developing myth that devices will not be able to boot once the certificates expire, just look at all the threads and posts in this forum.

This is the MS response.

Frequently asked questions about the Secure Boot update process - Microsoft Support

support.microsoft.com

UPDATE: Dell are giving the same answer as MS. See 3rd question.

Secure Boot Transition FAQ | Dell US

We will find out the real answer later on in 2026.

gunrunnerjohn · Nov 25, 2025

Marcus Vinicus said:
This is the MS response.

View attachment 154325

Frequently asked questions about the Secure Boot update process - Microsoft Support

support.microsoft.com

UPDATE: Dell are giving the same answer as MS. See 3rd question.

Secure Boot Transition FAQ | Dell US

We will find out the real answer later on in 2026.

A moot point for me, all my systems are updated and booting with the 2023 Cert and Secure Boot.

Anibor_11 · Nov 25, 2025

According to Mosby:

"Whereas, in itself, this [expiration] will not prevent existing Secure Boot signed bootloaders from validating (as long as they haven't been revoked through other means) it will however prevent any newer UEFI bootloader from doing so which basically means that, if your OS or OS installer was produced after those DB certificates expire, and you don't have the additional 2023 DB certificates installed (see below), then, come the second half of 2026,you will not be able to boot or even install a Secure Boot compatible OS in a Secure Boot enabled environment!"

Dirtyflash · Nov 25, 2025

Anibor_11 said:
According to Mosby:

Whereas, in itself, this [expiration] will not prevent existing Secure Boot signed bootloaders from validating (as long as they haven't been revoked through other means) it will however prevent any newer UEFI bootloader from doing so which basically means that, if your OS or OS installer was produced after those DB certificates expire, and you don't have the additional 2023 DB certificates installed (see below), then, come the second half of 2026,you will not be able to boot or even install a Secure Boot compatible OS in a Secure Boot enabled environment!

So at the very minimum, if you have Windows UEFI CA 2023 installed, then come the second half of 2026, you'll be able to install or boot a future Secure Boot compatible OS in the Secure Boot environment? Do I have that right?

Anibor_11 · Nov 25, 2025

Dirtyflash said:
So at the very minimum, if you have Windows UEFI CA 2023 installed, then come the second half of 2026, you'll be able to install or boot a future Secure Boot compatible OS in the Secure Boot environment? Do I have that right?

Yes.

XxXxX · Nov 25, 2025

i would hazard a guess that if you dont have the secure boot 2023 cert in place and available for the system
you wont be able to directly upgrade too or clean install Windows 12 when it becomes available.

im sure workarounds can and will be found, just my thoughts.
best of luck Steve ..

wabbit · Nov 25, 2025

XxXxX said:
i would hazard a guess that if you dont have the secure boot 2023 cert in place and available for the system
you wont be able to directly upgrade too or clean install Windows 12 when it becomes available.

im sure workarounds can and will be found, just my thoughts.
best of luck Steve ..

Just like the hard un by passable requirement for SSE 4.2 for 24H2 and beyond, I wouldn't be shocked if future versions of Windows 11 or Windows 12 have a requirement to have CA 2023 secure boot certificate.

Brian48 · Nov 25, 2025

Ghot said:
Worked for me as follows...

1. Download the script at the bottom of this post.
2. Extract the Check-SecureBootCerts.ps1 script and place it on your desktop.
3. Go to: C:\Users\your account name\Desktop and right click Desktop and choose: Open in Terminal
4. In the powershell windows that pops up, type the following...

.\Check-SecureBootCerts.ps1 and hit the ENTER key.

This is what I get when following the instructions exactly except my Desktop is in the OneDrive folder.

KevTech · Nov 25, 2025

Brian48 said:
This is what I get when following the instructions exactly except my Desktop is in the OneDrive folder.

Try in powershell:

Code:

powershell -nop -ep bypass -f "C:\users\Brian\OneDrive\Desktop\Check-SecureBootCerts.ps1"

fg2001gf11F · Nov 25, 2025

Brian48 said:
This is what I get when following the instructions exactly except my Desktop is in the OneDrive folder.

I think you get that red message if you don't open PS as Administrator.

Brian48 · Nov 25, 2025

KevTech said:
Try in powershell:

powershell -nop -ep bypass -f "C:\users\Brian\OneDrive\Desktop\Check-SecureBootCerts.ps1"

Thanks, That worked

gunrunnerjohn · Nov 26, 2025

fg2001gf11F said:
I think you get that red message if you don't open PS as Administrator.

Actually, you just have to enable running scripts in PowerShell. Open PowerShell as Admin and use the following command.

To allow just signed scripts...

Set-ExecutionPolicy RemoteSigned

To allow any script...

Set-ExecutionPolicy Unrestricted

RJARRRPCGP · Nov 26, 2025

Ghot said:
View attachment 152800

I got the same thing too, when not using PowerShell.

The PowerShell script that was around for a while:

->But, I still don't have the Microsoft UEFI CA 2023 !

Code:

Secure Boot: ON

BitLocker on (C:) OFF


UEFI KEK Certs

--------------

    Microsoft Corporation KEK CA 2011

    Microsoft Corporation KEK 2K CA 2023


UEFI DB Certs

-------------

    Microsoft Corporation UEFI CA 2011

    Microsoft Windows Production PCA 2011

    Windows UEFI CA 2023


UEFI DBX Certs

--------------

    Microsoft Windows Production PCA 2011


EFI Files

---------

    Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED.


    Registry: WindowsUEFICA2023Capable = 2

        [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager.

Buddywh · Nov 26, 2025

RJARRRPCGP said:
->But, I still don't have the Microsoft UEFI CA 2023 !

Your Windows is booting with a CA 2023 boot manager now, which is validated and authorized by the Windows UEFI CA 2023 key to run with Secure Boot enabled. It's not really a requirement for Windows itself, it's used with many Linux distro's, some bootable utilities and some hardware option ROMs. In other words, to validate certain third party softwares (other than Windows) that are signed with a Microsoft Corp UEFI CA 2023 certificate. Any softwares you currently have that are signed by the Microsoft Corp UEFI CA 2011 key will continue to function since it's not had trust revoked.

You also don't have the Option ROM CA 2023 key.

I think some of the updated BIOS's with 2023 keys come this way: either missing the Microsoft key, or the OpROM key or both. One of the BIOS updates for my machines did at least.

RJARRRPCGP · Nov 26, 2025

Buddywh said:
Your Windows is booting with a CA 2023 boot manager now, which is validated and authorized by the Windows UEFI CA 2023 key to run with Secure Boot enabled. It's not really a requirement for Windows itself, it's used with many Linux distro's, some bootable utilities and some hardware option ROMs.

You also don't have the Option ROM CA 2023 key.

Yeah, I did mention that, but replaced it with that line. I forgot to say that the one for option ROMs, wasn't added, either.

I wondered if missing the "Microsoft UEFI CA 2023" would cause video drivers to not work anymore in 2026.
I have "Windows UEFI CA 2023", OTOH, but, apparently, I'm still not off the hook.

Solved Secure boot update HowTo

Member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computer

Semper paratus

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Just a Computer User

My Computers

Well-known member

My Computers

Active member

Attachments

My Computer

Well-known member

My Computer

Well-known member

My Computer

Active member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Similar threads