Share via

Secure boot

Vishal Kumar 0 Reputation points
2026-06-03T05:23:03.0333333+00:00

Secure Boot is a security feature in Unified Extensible Firmware Interface​​​​​​​ (UEFI) based firmware that helps ensure that only trusted software runs during a device's boot (start) sequence. It works by verifying the digital signature of pre-boot software against a set of trusted digital certificates (also known as certificate authority or CA) stored in the device's firmware. As an industry standard, UEFI Secure Boot defines how platform firmware manages the certificates, authenticates firmware, and how the operating system (OS) interfaces with this process. For more details on UEFI and Secure Boot, please see Secure boot.

Windows for home | Windows 11 | Install and upgrade
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-03T05:23:15.8+00:00

    Secure Boot is a security standard and feature of UEFI-based firmware that ensures a PC or device boots only with software trusted by the device or PC manufacturer.

    During startup, the UEFI firmware:

    1. Verifies the digital signature of each piece of boot software (UEFI firmware drivers/Option ROMs, EFI applications, and the operating system bootloader and drivers) against a set of trusted digital certificates stored in firmware.
    2. If all signatures are valid and trusted according to the Secure Boot policy, the firmware allows the boot process to continue and hands control to the operating system.
    3. If any component is not trusted or has been tampered with, it is blocked from running, helping to prevent pre-boot malware such as bootkits and firmware rootkits.

    Secure Boot relies on a public key infrastructure (PKI) and a hierarchy of keys and certificate databases in firmware:

    • Platform Key (PK) – typically owned by the hardware manufacturer; establishes control of the platform.
    • Key Exchange Key (KEK) – used to authorize updates to the Secure Boot databases; may include Microsoft and OEM KEKs.
    • Allowed Signature Database (DB) – contains certificates and signatures for code that is allowed to run.
    • Disallowed Signature Database (DBX) – contains revoked or blocked certificates and signatures.

    Windows 8 and later, including Windows 11, use UEFI Secure Boot as part of the Trusted Boot architecture to protect the boot process by enforcing signature checks from firmware through the Windows kernel and early boot drivers.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.