How to Check the 2023 Secure Boot Certificate Status in Windows 11

Microsoft has been moving Windows devices from Secure Boot certificates issued in 2011 to newer 2023 certificates. The older certificates reached their 2026 expiry window, so it is worth checking whether your PC completed the transition.

A PC with an incomplete transition may continue to boot and receive normal Windows updates, but it can miss future protection for early boot components.

Step 1: Make sure Windows and firmware are current

1. Open Settings > Windows Update and install available updates.
2. Restart the PC.
3. Check your PC or motherboard manufacturer for a current BIOS/UEFI firmware update.

Firmware compatibility matters because Secure Boot certificates ultimately have to be accepted by the device firmware.

Step 2: Check the Secure Boot update status

Advanced users can open Registry Editor and check:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

Look for UEFICA2023Status. A value of Updated indicates the 2023 certificate update has completed from Windows’ perspective.

Step 3: Check Event Viewer if the update is incomplete

Open Event Viewer > Windows Logs > System and look for related Secure Boot/TPM-WMI events. Microsoft specifically documents events such as 1801 and 1795 as indicators that remediation is incomplete or firmware rejected part of the update.

What should you do if it is not updated?

Do not download random Secure Boot scripts or manually replace firmware keys from an unknown source. First update Windows and the OEM firmware, restart, and recheck the status.

On business-managed PCs, Secure Boot certificate deployment can be controlled through Intune, Group Policy, CSP, or supported registry-based deployment. Follow your organization’s process rather than changing it manually.

Official references

• Microsoft: update secure boot certificates
• Microsoft: Secure Boot registry status reference