The Microsoft certificates used by Secure Boot, issued in 2011, expire in 2026. Windows replaces them with 2023 certificates, normally automatically through Windows Update. Since April 2026, the Windows Security app shows where this update stands. If it says "Not yet updated", shows a yellow badge or a red icon, this guide helps you read the exact message and apply the right action. It also applies to Windows 10, as long as the PC still receives security updates.
Problem
- In Windows Security > Device security > Secure Boot, the status says Not yet updated or Action required.
- A yellow badge or red icon appears on the Device security icon, or in the notification area.
- The message mentions an "older boot trust configuration" or "hardware or firmware limitations", or says the device "can no longer receive required updates".
What to know before you act
- Expiry dates (Microsoft): the Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates expire in June 2026, and Microsoft Windows Production PCA 2011 on October 19, 2026. They're replaced by 2023 certificates, including Windows UEFI CA 2023.
- The PC keeps booting: according to Microsoft, a device left on the old certificates still starts and works normally, and regular Windows updates keep installing. However, it no longer receives new boot protections: Boot Manager updates, revocation database updates and fixes for flaws in the boot chain.
- Don't disable Secure Boot to make the warning go away. Microsoft explicitly advises against it: it significantly reduces device protection.
- A green checkmark isn't enough: Microsoft says you should also look for the text "Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed."
- Windows 10: support ended on October 14, 2025. To keep receiving security updates, including Secure Boot ones, you need to be enrolled in the Extended Security Updates (ESU) program.
- Work PCs: on a device managed by an organization, the badges and notifications are turned off by default and deployment is handled by IT. This guide is for personal PCs.
Step 1: read the exact message in Windows Security
When to use it: always first. The action depends on the message shown.
Suggested solution
- Open Windows Security, then Device security, then the Secure Boot section.
- Compare the message with the table below (texts published by Microsoft).
| Message shown in the Secure Boot section | Action given by Microsoft |
|---|---|
| "…all required certificate updates have been applied. No further certificate changes are needed." | No action. |
| "…your device is using an older boot trust configuration that should be updated." | Install the latest Windows updates and restart if prompted (step 2). |
| "…affected by a known issue… Secure Boot certificate updates are temporarily paused…" | No action: the update will resume automatically. |
| "…There is not yet enough data to classify your device for automatic update…" | The device may need extra validation. See aka.ms/getsecureboot. |
| "…does not support the automated Secure Boot certificate update due to hardware or firmware limitations." | Contact the PC or motherboard manufacturer (step 4). |
| "…this device can no longer receive required updates for the Windows boot experience." | The device still uses an old certificate after expiry. See aka.ms/getsecureboot, then steps 2 to 4. |
| "Secure boot is off, your device may be vulnerable." | A separate issue from the certificates: see step 3. |
Expected result: you know which case applies to you. If the message says "no action", you can stop here.
Step 2: install all Windows updates
When to use it: the message mentions an older boot trust configuration, or the status is "Not yet updated".
Suggested solution
- Open Settings > Windows Update and check that updates are not paused.
- Select Check for updates and install everything offered, including cumulative updates.
- Restart the PC, even if Windows doesn't ask right away.
- Leave the PC on and connected to the internet for a while. According to Microsoft, the scheduled task that applies the certificates runs at startup and every 12 hours. Reaching "Fully updated" may therefore take several restarts and some patience.
- Go back to Windows Security > Device security and read the message again.
Expected result: the message changes to "…all required certificate updates have been applied…".
When to move on: if nothing changes after several days and several restarts, go to step 3.
Step 3: check the actual state (Secure Boot, task, certificates)
When to use it: the status doesn't progress despite the updates.
Suggested solution
- Is Secure Boot on? Press Windows + R, type
msinfo32, then press Enter. In System Information, the Secure Boot State line should say On. If not, first see the French guide Ce PC ne répond pas actuellement à la configuration requise pour Windows 11 (TPM 2.0, démarrage sécurisé) : vérifier et activer and the manufacturer's documentation. Microsoft recommends checking with the manufacturer that the firmware is up to date before changing Secure Boot settings. - Is the update task enabled? Open PowerShell as administrator and run the command given by Microsoft:
schtasks.exe /Query /TN "\Microsoft\Windows\PI\Secure-Boot-Update" /FO LIST /V
The status field should say Ready ("Prêt" on French Windows). If the task is disabled or not found, the certificate update can't progress. In that case, post the output in this topic before changing anything.
Suggested solution
- Where does the update stand? Still as administrator, read the tracking key documented by Microsoft. This command only reads, it changes nothing:
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" | Select-Object UEFICA2023Status, UEFICA2023Error
UEFICA2023Statusis NotStarted (not started yet), InProgress or Updated (done).- A
UEFICA2023Errorvalue other than 0 indicates an error. - If the key doesn't exist at all, Microsoft says the process never started. Possible causes are a disabled task, Secure Boot turned off or an unsupported Windows version.
Suggested solution
- Is the 2023 certificate present? On Windows updated since April 2026, Microsoft documents a readable parameter:
Get-SecureBootUEFI -Name db -Decoded
Look for an entry Subject : CN=Windows UEFI CA 2023. Its presence shows the new certificate is in the firmware database. The full status remains the one shown by Windows Security.
Expected result: you know whether the blocker is Secure Boot being off, the scheduled task or an update error.
Step 4: update the BIOS/UEFI or contact the manufacturer
When to use it: the message mentions hardware or firmware limitations, or UEFICA2023Error shows a persistent error.
Suggested solution
- Note the exact laptop model, or the motherboard model for a custom-built PC.
- Check the manufacturer's support page. Microsoft maintains a list of Original Equipment Manufacturer (OEM) pages for Secure Boot.
- Install the latest BIOS/UEFI version offered, following the manufacturer's procedure strictly (on mains power, no interruption).
- Restart, then repeat step 2.
According to Microsoft, these firmware updates are sometimes only available for devices still within their support period. On an older PC, there may be no update at all.
Expected result: after the firmware update, Windows can finish installing the certificates.
When to stop: if the manufacturer offers no update, the device will keep booting, but without the new boot protections. Don't disable Secure Boot because of it.
Special cases
| Situation | What to know |
|---|---|
| BitLocker recovery screen right after the update | Microsoft describes a case where the prompt appears only once: enter the 48-digit recovery key, then check for firmware updates. To find the key, see the French guide Écran de récupération BitLocker au démarrage : trouver la clé. |
| BitLocker asks for the key on every boot | According to Microsoft, this can come from network boot (PXE) placed before the disk in the boot order. Put the Windows disk first and disable PXE if you don't use it. |
| The PC no longer boots after a BIOS reset or resetting Secure Boot keys to "default" | Microsoft explains that a reset can erase the 2023 certificates from the firmware database. It describes a recovery with SecureBootRecovery.efi in its troubleshooting guide. Avoid resetting Secure Boot keys to factory defaults until the manufacturer provides defaults that include the 2023 certificates. |
| The PC no longer boots right after the certificate update | Microsoft mentions a defect in some firmware. Start with the manufacturer's support page. Microsoft mentions temporarily disabling Secure Boot as a troubleshooting step to get the PC to start, not as a lasting fix. |
| A yellow warning you want to hide | The Dismiss button exists. For a red state, the option is I accept the risks, don't remind me (administrator rights). Microsoft advises against dismissing the warning if the certificates aren't updated yet. |
Final check
- ☐ The message in the Secure Boot section was read in full, not just the badge color.
- ☐ Windows Update isn't paused and all updates are installed.
- ☐
msinfo32shows Secure Boot On. - ☐ The
Secure-Boot-Updatetask is in the Ready state. - ☐
UEFICA2023Statussays Updated, or the BIOS/UEFI was updated if a hardware limitation is reported.
Sources
- Microsoft: Secure Boot certificate update status in the Windows Security app (KB 5087130)
- Microsoft: Windows Secure Boot certificate expiration and CA updates
- Microsoft: When Secure Boot certificates expire on Windows devices (KB 5079373)
- Microsoft: Windows devices for home users, businesses, and schools with Microsoft-managed updates (KB 5062711)
- Microsoft: Secure Boot troubleshooting guide (scheduled task, Servicing key, BitLocker, recovery)
- Microsoft: PowerShell: Using the -Decoded parameter in Get-SecureBootUEFI (KB 5093574)
- Microsoft: Known issues and resolutions for Secure Boot certificates updates (KB 5085790)
Still having the problem?
Reply in this topic with your Windows version (press Windows + R, then type winver), the brand and model of the PC or motherboard with the BIOS version, the exact message shown in the Secure Boot section, and the output of the schtasks and Get-ItemProperty commands from step 3. Never post your BitLocker recovery key, serial number, email address or passwords.