Secure Boot is an important security feature built into modern Windows systems that protects your computer during the startup process. It ensures that only trusted and signed software can run when the system boots, preventing malicious code or rootkits from loading before the operating system starts. This feature works through a set of digital certificates stored in the system firmware.
In 2023, Microsoft introduced updated Secure Boot certificates to strengthen the security of Windows devices and replace older signing certificates that will eventually expire. Systems that do not install these updated certificates before June 2026 may encounter boot issues, especially when installing newer Windows updates or firmware updates that rely on the new certificate chain.
Because of this change, it is important to verify whether your Windows 11 PC has already received the updated 2023 Secure Boot certificates. In this guide, we will walk you through the methods you can use to check if your PC has the new Secure Boot certificates installed.
How to Check If Your PC Has the New 2023 Secure Boot Certificates (Before June 2026)
Follow the methods below to verify whether the updated Secure Boot certificates are present on your system.
1. Check Secure Boot Status Using System Information
Before verifying certificates, confirm that Secure Boot is enabled on your system.
- Press Windows + R to open the Run dialog box.
- Type the following command and press Enter: msinfo32
- The System Information window will open.
- Locate Secure Boot State in the right panel.
- Verify that the value is set to On.
If Secure Boot is enabled, your system is capable of using updated Secure Boot certificates.
2. Check Secure Boot Certificates Using PowerShell
PowerShell allows you to check the Secure Boot database stored in system firmware.
- Right-click the Start button.
- Select Terminal (Admin) or Windows PowerShell (Admin).
- Run the following command: Confirm-SecureBootUEFI
- Press Enter.
- If the result returns True, Secure Boot is enabled.
Next, you can view Secure Boot variables.
- Run the following command: Get-SecureBootUEFI -Name db
- Review the certificate information returned by the command.
The output contains details about trusted Secure Boot signatures stored in the system.
3. Verify That the Latest Windows Security Updates Are Installed
The new Secure Boot certificates are delivered through Windows security updates.
- Press Windows + I to open the Settings app.
- Click Windows Update.
- Select Update history.
- Review the list of installed Security Updates.
- Ensure that the latest cumulative updates for Windows 11 are installed.
Installing the latest updates ensures that your system receives firmware and security certificate updates provided by Microsoft.
4. Check Firmware Updates from Your PC Manufacturer
Some Secure Boot certificate updates may also be delivered through BIOS or UEFI firmware updates.
- Press Windows + S and search for System Information.
- Locate the BIOS Version/Date entry.
- Visit your computer manufacturer’s support website.
- Search for your specific PC model.
- Check whether newer BIOS or firmware updates are available.
- Install firmware updates if recommended.
Firmware updates may include updated Secure Boot keys and security improvements.
5. Confirm Secure Boot Key Updates in the UEFI Firmware
Advanced users can verify Secure Boot keys directly from the system firmware.
- Restart your computer.
- Enter the BIOS or UEFI setup during startup (commonly by pressing F2, Delete, Esc, or F10).
- Navigate to the Secure Boot section.
- Locate options related to:
- Platform Key (PK)
- Key Exchange Keys (KEK)
- Signature Database (db)
- Forbidden Signatures Database (dbx)
- Verify that the Secure Boot keys are updated and active.
- Exit the firmware setup without making changes if everything appears correct.
These keys contain the certificates used by Secure Boot to verify trusted software during startup.
Conclusion
The updated 2023 Secure Boot certificates are an important security improvement designed to replace older signing certificates before their expiration in June 2026. Systems that do not receive these updates may encounter compatibility issues with future Windows updates and security features.
By checking Secure Boot status through System Information, verifying Secure Boot variables using PowerShell, ensuring Windows security updates are installed, updating system firmware, and reviewing Secure Boot keys in UEFI firmware, you can confirm that your Windows 11 PC is properly configured with the latest Secure Boot certificates. Keeping these security components up to date helps ensure that your system remains protected against low-level boot threats.
