security boot

Question

how to fix security boot is on but does not support the automated secure boot certificate due to hardware or firmware limitations

Answer 1

I recommend to update the BIOS to latest version, see if it helps.

Answer 2

You cannot manually update the Secure Boot Certificates yourself, that will be applied by Windows udpates automatically, Microsoft have only started releasing the updates in the May and June updates and they indicate they will continue to release the certificate updates over the next few months.

Go to the support page for your PC on the manufacturers website, to ensure you have installed all available BIOS and Firmware updates

Answer 3

"Not Supported - Known Limitation" in a Secure Boot certificate report means the device’s hardware or firmware cannot use the automated Secure Boot certificate update path. There is no supported way to make such a device use the automatic update mechanism.

For a home Windows 11 device, the practical options are:

1. Keep Secure Boot on for protection

• Secure Boot still helps prevent malicious bootloaders from running.
• The limitation only affects the automated certificate update path, not normal day‑to‑day use.

2. Manually manage firmware/UEFI updates

• Check the PC or motherboard manufacturer’s support site for:
  • BIOS/UEFI firmware updates
  • Any Secure Boot–related updates or guidance
• Apply any recommended firmware updates that mention Secure Boot or UEFI security.

3. Plan for long‑term security

• After the older Secure Boot–related certificates expire, devices that don’t get updated certificates will still boot and receive normal Windows updates, but they will no longer receive new boot‑level security protections (for example, updates to Windows Boot Manager, Secure Boot databases, or revocation lists).
• For long‑term security, consider:
  • Working with the OEM to see if a firmware update or manual certificate update path is available.
  • If the OEM confirms no support, planning to move to newer hardware that supports the updated Secure Boot certificate path.

4. Do not try to force certificate changes

• Guidance for managed environments explicitly warns not to force untrusting old certificates without validating firmware support, because the device might fail to boot.
• On a home device with this limitation, avoid unsupported tools or scripts that claim to “fix” Secure Boot certificates; they can leave the PC unbootable.

If the device is critical and the OEM offers no path to support the new certificates, the only complete fix is replacement with hardware that fully supports the updated Secure Boot certificate mechanism.

---

References:

• Secure Boot status report in Windows Autopatch
• Manage Secure Boot updates
• Windows devices for home users, businesses, and schools with Microsoft-managed updates
• Windows 11 and Secure Boot