Update Your Windows Secure Boot Certificates Before They Expire: A Comprehensive Guide

For users with PCs older than two years, an important update is on the horizon: the expiration of Windows Secure Boot certificates in June 2026. As your current certificates lapse, you will lose access to crucial Secure Boot updates, which could lead to potential boot problems. Although Microsoft is incrementally releasing new certificates via Windows Update, you can bypass the uncertainty of this rollout by following our guide to manually update your Secure Boot certificates today.

Understanding Secure Boot Certificates

Secure Boot is an essential feature within UEFI firmware that ensures your computer only boots with software that has been digitally signed by trusted manufacturers. This security measure involves a multi-step authentication process, initiated by the use of public certificates that validate the software’s origin before any code is executed.

Your PC’s UEFI firmware stores a roster of manufacturer certificates, functioning similarly to ID cards. They verify that the software originates from a trusted source, thereby offering a robust defense against malicious entities like bootkits and rootkits, which cannot operate without certificates from recognized manufacturers.

The Importance of Updating Secure Boot Certificates

Like many digital certificates, Secure Boot certificates have an expiration date. Most PCs manufactured before 2024 utilize the Microsoft Corporation UEFI CA 2011 certificates, which are set to expire in June 2026. Once these certificates reach their expiration, your device will no longer receive updates for Windows Boot Manager, leaving your system vulnerable to emerging threats and complicating compatibility with new hardware that requires recent signatures.

It is imperative to transition to the latest Windows UEFI CA 2023 certificates. While Microsoft is collaborating with OEMs to facilitate this transition through Windows Updates, manually updating the certificates sooner offers several advantages:

There’s no assurance Microsoft will deploy these certificates to your specific device before the expiration date; the rollout is prioritized based on device significance, which could leave you waiting indefinitely.
The older 2011 certificates are susceptible to vulnerabilities such as the BlackLotus bootkit, which can circumvent Secure Boot. Updating now bolsters your security immediately.
If Windows updates are disabled, or if you prefer a more hands-on approach to managing updates, manual installation of the certificates is necessary.
Updating your certificates on your schedule ensures that your recovery drive remains functional, avoiding potential issues down the line.

While the lack of an immediate certificate update will not lock you out of your PC, it does heighten security risks and impede future system upgrades.

Verifying Your PC’s Secure Boot Certificates

There’s a possibility that Microsoft has pre-activated the new certificates on your PC. You can easily check this using PowerShell.

To begin, search for “PowerShell” in the Windows Search bar, right-click on Windows PowerShell, and select Run as administrator.

Next, input the following command:

[System. Text. Encoding]::ASCII. GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

running command to check secure boot certificates

If the output returns True, your certificate is up to date, and no further action is required. If it displays False, it’s time to proceed with updating the certificates.

Steps to Install the 2023 Secure Boot Certificates

The Windows UEFI CA 2023 certificates are likely already present on your PC. These were included in the Windows 11 February 2024 cumulative update but remain inactive. If your system has been updated post the February 2024 release, you can activate these certificates following these steps:

Once again, start PowerShell as an administrator and execute this command:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

This command modifies the Registry to set the stage for deploying the 2023 certificates. The 0x5944 bitmask in the command activates six instructions that prepare your PC for the installation of the Windows UEFI CA 2023.

To execute the newly configured instructions, issue the following command in PowerShell:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

This command initiates the necessary tasks to install the certificates during your next boot cycle, including compatibility checks and relocating new certificates from the WinSxS folder to the appropriate staging area. You may notice slight freezing on your PC while this command processes.

Crucially, restart your Windows twice. It’s essential to restart the PC rather than merely shutting it down and turning it back on. If Fast Startup is enabled, shutting down will not clear the memory fully as required for these changes to be effective.

Congratulations! Your PC now boasts the latest Secure Boot certificates, valid until 2038. While you should not encounter any issues, should complications arise, consult the guides for resolving Windows startup problems or managing infinite boot loops.

Source & Images