Secure Boot Certificates

The Secure Boot Certificates check verifies on Windows devices (x64 and Arm64) whether the migration from the expiring 2011 Microsoft Secure Boot certificates to the 2023 certificate authorities (CAs) has arrived. It reads the UEFI KEK and DB variables directly on the device and also checks the deployment status that Windows reports in the registry. It runs every 60 minutes by default.

Devices without the 2023 certificates keep booting, but no longer receive DB/DBX updates, bootkit revocations, or boot manager updates.

Steps

1. Go to Devices and open the device.
2. In the Checks tab, click Add Check → Secure Boot Certificates.
3. Adjust the settings if needed.
4. Click Add Check.

For many devices, assign the check through a config package.

Settings

Results

The overall result is the worst severity of all findings.

If a 2023 certificate is missing, the detail view also shows until when the corresponding 2011 CA is valid, or that it has already expired.

• A local query may take at most 60 seconds; after that the check reports Failure.
• Disabled Secure Boot does not prevent the certificate check: the check still evaluates KEK and DB.
• If the deployment has not started and the KEK 2K CA 2023 is missing, the detail view shows a hint on how to start the Windows deployment: set the AvailableUpdates registry value to 0x5944 and trigger the scheduled task \Microsoft\Windows\PI\Secure-Boot-Update.

The check collects:

• Whether Secure Boot is enabled and whether the device boots with UEFI
• Presence of KEK 2K CA 2023 (KEK), Windows UEFI CA 2023 (DB), Microsoft UEFI CA 2023 (third-party, DB), and Option ROM UEFI CA 2023 (DB)
• Whether the boot manager already starts signed with the 2023 certificate
• Deployment status (Not started, In progress, Completed) and the AvailableUpdates registry value

See also: Set up alerts for a check