Full Breakdown
Microsoft Updates Secure Boot Certificates for Windows 11
2/14/2026, 10:42:39 PM
Overview of the Secure Boot Certificate Transition
In February 2026, Microsoft initiated a phased rollout of new Secure Boot certificates for Windows 11, transitioning from certificates established in 2011 to the new Windows UEFI CA 2023. This update aims to enhance the security of the boot process by ensuring that only trusted firmware and software components are loaded before Windows starts. The transition is part of a broader effort to maintain system integrity as older certificates reach the end of their usable life.
Key Events and Timeline
- June 2025: Microsoft announced plans to deprecate Secure Boot certificates from 2011, with updates scheduled to begin in June 2026.
- February 2026: The rollout of the new Secure Boot certificates commenced with the Windows 11 update (KB5077181), marking the beginning of the transition process.
Understanding the Update Process
The update process involves two main steps:
1. The new Secure Boot certificate becomes available to Windows.
2. The certificate is applied to the system firmware.
During this transition, many users may encounter Event Viewer logs indicating that updated certificates are available but not yet applied. These logs, which may include messages like “updated certificates available” or “under observation,” do not signify errors but rather indicate that the system is being prepared for the update.
How to Check for Certificate Updates
Users can verify whether the new Secure Boot certificate is present on their systems using PowerShell. The command `[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'` will return "True" if the certificate is applied, or "False" if it is not yet available. Additionally, users can check Event Viewer for Event ID 1808, which confirms the successful application of the new certificate.
Criticism and Concerns
Some users have expressed confusion regarding the update process, particularly when PowerShell indicates that the new certificate is present while Event Viewer still logs pending updates. This discrepancy is normal, as the operating system update can occur before the firmware application. Critics caution against rushing into BIOS updates, emphasizing that firmware changes are managed by device manufacturers like Dell, Lenovo, and HP, and should only be performed when explicitly instructed.
Official Statements & Responses
Microsoft has clarified that the transition to new Secure Boot certificates is a coordinated effort with OEMs to ensure compatibility and security. The company has stated, “The change has to be coordinated carefully to avoid devices becoming unbootable if something goes wrong.” Users are advised to avoid manual modifications to firmware settings unless they are comfortable with the associated risks.
What's Next?
As the rollout continues, users are encouraged to keep their systems updated and monitor for any notifications regarding the Secure Boot certificate transition. Microsoft will continue to provide updates throughout 2026, ensuring that systems remain secure and functional.
Verbatim Quotes
- “Because of that, the change has to be coordinated carefully to avoid devices becoming unbootable if something goes wrong.” — Microsoft Official Statement
- “If PowerShell returns True, your system already has what it needs.” — Windows Update Guide
- “Expired certificates will definitely prevent Windows from keeping boot-time security features and databases current, which may open your system up to vulnerabilities.” — Security Advisory
