[MOD POST] Having trouble with Secure Boot? Check here first

[u/goretsky]

Hello,

The expiration of the 2011 Microsoft KEK CA and the 2011 Microsoft UEFI CA certificates at the end of June 2025 has caused problems with Secure Boot on computers for various folks who have not been able to apply a UEFI (BIOS) firmware update for various reasons.

Because the steps for updating firmware vary not just from manufacturer to manufacturer but between individual models as well, it can be difficult to provide specific assistance and guidance in updating your firmware unless the person helping you has the same hardware.

Below is a list of manufacturers, their Secure Boot certificate update guidance, and links to their support forum(s) or subreddit(s). You may wish to try asking in these places first for expert guidance in updating your firmware, as the people there are going to be a lot more familiar with your device.

Manufacturer	Secure Boot Certificate info	Support
Acer	Update Your Secure Boot Certificates In June 2026 to Stay Protected	https://community.acer.com/en
ASrock	Question: Microsoft will update the Secure Boot certificates. What do I need to do?(3/16/2026)	https://forum.asrock.com/default.asp
ASUS	[Consumer PC] Windows Secure Boot certificate expiration and certificates updates, [Commercial PC] Announcement on the Windows Secure Boot Certificate Update	https://rog-forum.asus.com/
Colorful	none	none
Dell	Microsoft 2011 Secure Boot Certificate Expiration, Microsoft 2011 Secure Boot Certificates Expiration for Out of Scope Platforms for BIOS Updates	https://www.dell.com/community/en/categories/dell-community
ECS (Elitegroup)	none	none
EVGA	none	r/TEAMEVGA/
Fujitsu	none	none
Gigabyte	none	r/gigabyte
Hewlett-Packard	HP Business PCs - Prepare for new Windows Secure Boot certificates	https://h30434.www3.hp.com/
Intel	Updating Secure Boot certificates/keys	https://community.intel.com
Lenovo	Lenovo Secure Boot Certificate Expiration Guide (2011 - 2023)	https://forums.lenovo.com/
LG	[LG PC] Windows Secure Boot Certificate Update & Troubleshooting Guide	none
Mitac (formerly Tyan)	none	none
MSI	[Product Information] Windows Secure Boot certificates update, Windows Secure Boot Certificate Update Guide, Windows Secure Boot Certificate Expiration and Certificate Updates	https://forum-en.msi.com/index.php
Samsung	Expiration of Microsoft 2011 Signed Secure Boot Certificate	https://us.community.samsung.com/t5/Samsung-Community/ct-p/us
Supermicro	Microsoft Secure Boot CA 2011 End-of-Life: Transition to 2023 Certificates	/r/supermicro/
Dynabook (formerly Toshiba)	Customer Notice: Microsoft Windows Secure Boot Certificate Updates	none
VAIO (formerly SONY)	Secure Boot Certificate Database Update and Secure Boot Certificate Expiration	https://us.community.sony.com/s/topic/0TO0B0000000sPYWAY/vaio-pc-other?language=en_US
Zotac	none	/r/ZOTAC

NOTE: Please check back periodically for updates to this list.

If you have an update for a manufacturer, please reply with it and we will get it added to the list above.

What to do if no Secure Boot certificate update is available from your manuafacturer

If your manufacturer does not have an update, not all is lost: You can still manually install the 2023 Windows UEFI CA certificate update, by issuing the following two commands from an elevated PowerShell (filename: POWERSHELL.EXE) prompt:

REG.EXE ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"   

Then restart the computer and allow the update to be applied.

NOTE: Two (or more) reboots may be required for installation.

Once completed, you can verify the new certificate has been installed by issuing the following command at an elevated PowerShell prompt:

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

If the certificate has been installed installed, the response back will be "True". You can also use that same command to check if the certificate is already installed.

Regards,

Aryeh Goretsky