If you’re prevented from updating Secure Boot certificates

Introduction 

Microsoft is rolling out updated Secure Boot certificates to Windows devices to maintain protection against evolving boot-level threats. Most devices receive these updates automatically through Windows Update. This article explains why some devices are blocked from updating Secure Boot certificates, what this means, and what actions you can consider. 

A quick Secure Boot summary 

Secure Boot is a Windows feature that checks the PC each time it starts. Before Windows loads, Secure Boot verifies that the software about to run is signed by a trusted source. If the signature isn’t recognized, the PC won’t start that software. This blocks a major class of malware that might attempt to load before Windows starts. 

To protect your device, Secure Boot is designed so that only the original equipment manufacturer (OEM) can authorize changes to your PC at this root level.  

Why you might not have received a full update 

The Windows Security app is the easiest way to check whether your device’s Secure Boot status is up to date, or whether a firmware update from the manufacturer is required. 

On the vast majority of PCs, the full set of Secure Boot certificates install automatically through Windows Update. Some devices require a firmware update from the PC manufacturer before you can install the necessary Secure Boot updates. Many OEMs are actively releasing these firmware updates through their standard update channels. If a firmware update is required, check your OEM’s Secure Boot support page for next steps. 

In some cases, Windows Security might indicate that Secure Boot certificate updates are temporarily paused or blocked by displaying one of these messages: 

What happens if you can't install the new Secure Boot certificates?

If your device reaches the expiration date without the new certificates, it will continue to start and operate normally. Standard Windows updates will still be installed. However, as new security updates are released that address threats to the early boot process, your device won’t be able to receive them and won’t get the latest protections. 

Over time, as new threats emerge, a device in this expired state becomes progressively less protected.  Features that rely on Secure Boot—such as device encryption or certain startup software—might also stop working properly if they require updated security protection. 

Resources

• Learn more about Secure Boot