secure boot certificate

For Windows 11, Secure Boot certificate updates are typically delivered through Windows Update rather than by manually importing certificates.

Manual options supported in the provided guidance are:

1. Check whether the update is already installed
   • Open Settings → Windows Update → Update history.
   • Look under Other Updates for Secure Boot Allowed Signature Database (DB).
2. Check whether the 2023 certificate is present
   • Open PowerShell as Administrator.
   • Run:

          ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).Bytes) -match 'Windows UEFI CA 2023')
     

   • If the result is True, the updated certificate is already present.
3. Trigger the Windows Secure Boot update task manually
   • Open an elevated Command Prompt or PowerShell.
   • Run:

          reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
          Powershell -command Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
     

   • Restart the PC.
4. Check whether another pass is needed
   • Run:

          reg query HKLM\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates
     

   • If AvailableUpdates becomes 0x4100, run the scheduled task again and restart the PC again.
5. Update device firmware/BIOS if needed
   • Install the latest OEM firmware update from the PC manufacturer first, especially on older devices. Firmware updates can improve compatibility and reduce update failures.

Important:

• Firmware updates should be applied first when available.
• Test carefully on important systems, because Secure Boot and firmware changes can cause boot issues or BitLocker recovery prompts.
• Pilot validation is recommended before broad deployment.

References:

• Update Secure Boot Certificates for Windows Devices
• How to update secure boot certificate Windows 11 pro - Microsoft Q&A
• How to manually update Secure Boot certificates in Windows 11 ? - Microsoft Q&A