How to manually update secure boot certificate.

Question

How can I manually update secure boot certificate due to hardware or firmware limitations.

Answer 1

There is no method available to manually update the Secure Boot Certificates, that is automatically delivered through the Windows Update process and Microsoft have indicated while most PC's will get that update this month, they will continue to release new certificates over the next few months, all you can do is go to the support page for your PC on the manufacturers website to check for any BIOS or firmware updates that may be available and not yet installed.

Answer 2

Manual updates are supported, but hardware or firmware limitations must be addressed first to avoid boot issues.

Use this sequence:

1. Review devices and current certificates
   • Identify devices still using 2011 Secure Boot certificates and verify Secure Boot/certificate update status using inventory methods such as event logs and registry signals.
   • This helps confirm which systems still require the 2023 certificates.
2. Update OEM firmware first
   • Check for and install OEM firmware updates for the device, especially if it is an older model.
   • Firmware updates improve compatibility with Secure Boot certificate changes and reduce the chance of blocked or failed updates.
   • If firmware blocks a Secure Boot update, work with the OEM to obtain a firmware version that supports the new certificates. Do not force changes that might leave the firmware unable to boot.
3. Pilot on a small set of devices
   • Test the Secure Boot certificate update on a representative pilot group (different OEMs, firmware versions, BitLocker-enabled devices).
   • Confirm:
     • Certificates update successfully
     • Devices still boot normally
     • No unexpected BitLocker recovery prompts appear
4. Manually trigger the Secure Boot DB update (Windows UEFI CA 2023)
   • Windows updates released on or after February 13, 2024 include the ability to add the Windows UEFI CA 2023 certificate to the Secure Boot DB.
   • By default this DB update does not apply automatically; it must be explicitly enabled.
   • To manually trigger it on validated devices, set the registry key described in KB5036210:
     • Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
     • Name: AvailableUpdates
     • Value: 0x40
   • After setting the key, restart the device (a second restart may be required). This applies the Windows UEFI CA 2023 certificate to the Secure Boot DB so future boot loader updates can be installed.
5. Use supported deployment methods for broader rollout
   • For managed environments, use one supported method to control rollout (do not mix methods on the same device):
     • Microsoft Intune
     • Group Policy
     • Registry keys
     • Windows Configuration Service Provider (CSP) / WinCS CLI
   • Allow up to ~48 hours and one or more restarts for certificates to fully apply.
6. If firmware or hardware cannot be updated in time
   • Devices whose Secure Boot certificates are not updated before expiration will still boot and receive standard Windows updates.
   • However, they will no longer receive new boot-level protections, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for new boot vulnerabilities.
   • This weakens early-boot security over time, so updating firmware and certificates as soon as feasible is strongly recommended.
7. Troubleshooting and safety
   • If a Secure Boot update is blocked or postponed by firmware, follow the documented troubleshooting guidance and OEM-specific Secure Boot pages.
   • Do not attempt to remove trust in 2011 certificates or apply revocations without confirming that the firmware can boot with the 2023 certificates.

For detailed, step-by-step deployment and troubleshooting instructions, follow the Secure Boot playbook and KB articles referenced in the documentation.

---

References:

• Update Secure Boot Certificates for Windows Devices
• KB5036210: Deploying Windows UEFI CA 2023 certificate to Secure Boot Allowed Signature Database (DB)
• Manage Secure Boot updates
• Frequently asked questions about the Secure Boot update process
• Manage Secure Boot certificate updates
• Secure Boot Certificate Updates for Azure Virtual Desktop