manual installation of 2023 secure boot certificate

Question

manual installation of 2023 secure boot certificate

Answer 1

Hi,

In this case, you usually have to wait for the BIOS updates to come with the updated keys.

Search for msinfo32.exe in the search bar, take a screenshot, and post it here so we can see the correct laptop model or desktop configuration.

Thanks

Answer 2

For a Windows 11 Home device, manual installation is not generally the recommended path unless the device supports the update path and has the required firmware support.

Supported facts:

• The 2011 Secure Boot certificates begin expiring in June 2026.
• Devices that are not updated will usually still boot and continue receiving normal Windows updates.
• Without the newer 2023 certificates, devices may not receive future Secure Boot protections for early boot components.
• Most devices receive the updated certificates automatically through Windows Update, and some also require OEM firmware updates.

If a manual deployment is being attempted on Windows:

1. Install a Windows update released on or after February 13, 2024.
2. Open an elevated Command Prompt.
3. Set the registry value to deploy the DB update:

      reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x40 /f
   

4. Trigger the scheduled task:

      Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
   

5. Restart the device. In some cases, a second restart is required.
6. Verify the DB update in an elevated PowerShell window:

      [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
   

   The expected result is True.

Important cautions:

• This update is known to have compatibility issues on some devices, so Microsoft recommends testing carefully before broad rollout.
• If BitLocker is enabled, back up the BitLocker recovery key before making Secure Boot changes.
• Some devices need OEM firmware support. If the device manufacturer does not provide the required firmware or certificate support, there is no supported way to manually inject a standalone 2023 Secure Boot certificate.

For consumer PCs, the practical path is:

• install all current Windows updates
• install the latest BIOS/UEFI or firmware update from the device manufacturer
• then verify whether Windows UEFI CA 2023 is present

If the OEM has not provided support for that hardware, the device can usually continue to boot normally, but it may not receive future Secure Boot boot-level protections.

---

References:

• Windows Secure Boot certificate expiration and CA updates
• KB5036210: Deploying Windows UEFI CA 2023 certificate to Secure Boot Allowed Signature Database (DB)
• How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
• Update Secure Boot Certificates for Windows Devices
• 2023 Secure Boot Certificate not provided by OEM or Microsoft updates. - Microsoft Q&A
• Secure Boot Security Certificates - Microsoft Q&A
• apply the Microsoft Windows UEFI CA 2023 - Microsoft Q&A