Secure Boot Certificate Update 2026: How to Check and Fix It on Windows 11 and 10

Microsoft's original Secure Boot certificates from 2011 started expiring in June 2026, and Windows has been quietly replacing them with new 2023 certificates through Windows Update. On most PCs this happens in the background, sometimes with an extra restart. But on some machines the update gets stuck, fails, or needs a firmware update from the PC maker first.

This guide explains what's changing, what happens if your PC isn't updated, and exactly how to check your Secure Boot certificate status and fix it safely, without triggering a BitLocker lockout.

Quick answer: Run PowerShell as administrator and check Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" | Select UEFICA2023Status. Updated means you're done. If it says NotStarted, InProgress or Failed: install all Windows updates and your PC maker's latest BIOS/UEFI, back up your BitLocker recovery key, then run the Secure-Boot-Update scheduled task and restart twice. Look for Event ID 1808 to confirm success. Never turn Secure Boot off as a "fix".

Last updated: November 12, 2026.

Table of contents

• What is changing and why
• What happens if your PC isn't updated
• Check-and-fix flow
• Step 1: Check your Secure Boot certificate status
• Step 2: Prepare (BitLocker key, BIOS update)
• Step 3: Trigger the update
• Step 4: Verify with Event Viewer
• Event ID cheat sheet
• For IT admins
• What not to do
• FAQ

What is changing and why

Secure Boot is a UEFI firmware feature that only lets trusted, signed software start before Windows loads. That trust comes from certificates stored in your PC's firmware. The Microsoft certificates used since 2011 have reached the end of their life, so Microsoft is adding replacement certificates, including:

• Windows UEFI CA 2023: signs the Windows boot manager.
• Microsoft UEFI CA 2023: for third-party boot components such as Linux shims.
• Microsoft Option ROM UEFI CA 2023: for add-in hardware like some graphics and network cards.

Windows also installs a new boot manager signed with the 2023 certificate. That's why some PCs restart more than once during recent cumulative updates such as KB5132061.

What happens if your PC isn't updated

• Your PC still starts and works normally, and regular Windows updates still install.
• But it can't receive new early-boot security fixes: boot manager updates, Secure Boot database and revocation updates, and fixes for boot-chain vulnerabilities (the kind bootkits use).
• Security features that rely on Secure Boot trust, such as some BitLocker hardening, may be affected.

In short: nothing breaks today, but your PC slowly falls behind on protection at the most sensitive layer.

Check-and-fix flow

Step 1: Check your Secure Boot certificate status

Open PowerShell as administrator (right-click Start > Terminal (Admin)) and run these checks.

Is Secure Boot on?

Confirm-SecureBootUEFI

True means Secure Boot is enabled. False means it's off (this guide doesn't apply until it's on). An error usually means the PC uses legacy BIOS mode.

What's the update status?

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" | Select-Object UEFICA2023Status, UEFICA2023Error

• Updated: the new certificates are in place.
• NotStarted or InProgress: Windows hasn't finished yet.
• Failed: note the UEFICA2023Error number and check Event Viewer (Step 4).

Is the 2023 certificate in the firmware database?

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

True means the new Windows certificate is present.

You can also look in Windows Security > Device security > Secure boot; read the full status text, not just the green tick.

Step 2: Prepare (BitLocker key, BIOS update)

1. Save your BitLocker recovery key. Firmware and Secure Boot changes can trigger the blue BitLocker recovery screen. Here's how to find your BitLocker recovery key.
2. Install all Windows updates, including optional ones, and restart.
3. Update your BIOS/UEFI firmware from your PC maker's support site or tool (Lenovo Vantage, Dell Command Update, HP Support Assistant). Some models need new firmware before the certificates can be written. Lenovo users can use our Lenovo Vantage guide.
4. Optional but safer for one restart: suspend BitLocker:

   Suspend-BitLocker -MountPoint "C:" -RebootCount 1

Step 3: Trigger the update

Windows runs a scheduled task about every 12 hours to apply Secure Boot updates. You can start it yourself:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Then restart the PC twice. Some steps only complete during boot. Run the status check from Step 1 again.

If the status stays at NotStarted after a day and several restarts, your device may be waiting for Microsoft's staged rollout or a firmware update, or Microsoft may be holding it back because of a known firmware issue (see Event ID 1802 below).

Step 4: Verify with Event Viewer

1. Press Win + R, type eventvwr.msc.
2. Go to Windows Logs > System and click Filter Current Log.
3. Enter the Event IDs 1800,1801,1802,1803,1808.

Or in PowerShell:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1800,1801,1802,1803,1808} -MaxEvents 20 | Format-Table TimeCreated, Id, Message -Wrap

Event ID cheat sheet

Event ID	Meaning	What to do
1808	Finished: new certificates and the 2023-signed boot manager are installed	Nothing; you're done
1800	A conflict during this boot	Usually clears after a restart
1801	Updates not yet applied to firmware	Restart a few times; if it persists with no 1808, update BIOS/UEFI
1802	Microsoft blocked the update because of a known firmware problem	Wait for a BIOS update from your PC maker; don't force it
1803	No OEM-signed key found for your model	Contact your PC maker for a firmware update

For IT admins

• Inventory first: collect UEFICA2023Status across the fleet with Intune remediation scripts or your RMM, and group by model and firmware version.
• Firmware is the bottleneck: push OEM BIOS updates before (or with) the certificate update, model by model.
• Escrow BitLocker keys to Entra ID or AD before rollout, so help desk can recover locked-out users quickly.
• Watch dual-boot and Linux systems: machines that boot Linux or custom boot loaders need shims signed for the new UEFI CA 2023.
• Pilot ring: start with a few devices per model and monitor Event IDs 1801/1808 before broad deployment.
• Need scripts? Our PowerShell automation examples show how to collect values from many PCs.

What not to do

• Don't disable Secure Boot to make warnings go away. That removes far more protection than an outdated certificate.
• Don't clear Secure Boot keys or reset them to "setup mode" in the BIOS unless your PC maker tells you to. It can stop the PC from booting.
• Don't force the update on devices showing Event ID 1802; Microsoft blocked them for a reason.
• Don't run random "fix" scripts from the internet that write Secure Boot variables. Use Windows Update and your OEM's firmware.

FAQ

Will my PC stop booting when the 2011 certificates expire?

No. PCs keep starting and running normally. What stops is new boot-level security updates until the 2023 certificates are installed.

Do I need to do anything on a home PC?

Usually not. Most personal Windows PCs get the new certificates automatically through Windows Update. Check the status once; if it says Updated, you're done.

Why did my PC restart twice during the November update?

Some PCs apply the Secure Boot certificate and boot manager changes during the same update cycle, which needs an extra restart.

Can this trigger BitLocker recovery?

It can, especially when firmware or Secure Boot settings change. Keep your recovery key handy and suspend BitLocker for one restart if you're making firmware changes.

Does Windows 10 get the new certificates?

Windows 10 devices enrolled in Extended Security Updates (ESU) continue to receive security updates. Without ESU, Windows 10 doesn't get new updates; see our Windows 10 ESU guide.

My PC maker no longer supports my model. What now?

If no firmware update is available and Windows can't apply the certificates, the PC will keep working but miss future boot-level fixes. Plan to replace very old hardware on your normal refresh cycle.

Sources: Microsoft Support ("When Secure Boot certificates expire on Windows devices" and "Windows Secure Boot certificate expiration and CA updates") and Windows Forum's guide to checking Secure Boot certificate status. Checked on November 12, 2026.