Microsoft confirms Secure Boot update failing on some Windows 11 PCs, blocks update due to known issues

Microsoft has confirmed that Secure Boot certificate updates are failing or being blocked on some Windows 11 PCs due to known issues. The company says it is working with PC makers on a patch, but you may still need to take action if the certificate is blocked for other reasons.

In an updated support document first spotted by Windows Latest, Microsoft says it has paused the Secure Boot rollout for some PCs due to potential known issues. If your device is affected, you’ll now see a detailed error message in the Windows Security app:

Until now, the Windows Security app has told you to contact the device manufacturer if the Secure Boot certificate is outdated. But now, it also warns when Microsoft identifies new known issues that could cause problems when Secure Boot is updated.

“Devices in this group are affected by a known issue. To reduce risk, Secure Boot certificate updates are temporarily paused while Microsoft and partners work toward a supported resolution,” Microsoft explained in a document.

As you might be aware, Secure Boot certificates issued in 2011 or earlier have now expired, and Microsoft has been trying to replace them with a new certificate issued in 2023.

The company said all “eligible” PCs will automatically start using supported certificates via Windows Update, but that’s not the case for all PCs, including some fully supported hardware where other configurations or compatibility settings could possibly halt the rollout.

I’m not really surprised, as Windows Latest’s veteran journalist Ed found that Windows PCs, particularly older ones, have a firmware problem, and many are not ready for the D-day, which has already passed.

Microsoft confirms some PCs are blocked from getting new Secure Boot certificates

I’ve been asking Microsoft tough questions around Secure Boot certificates, and so far, it’s quite impressive how the Windows giant has tackled the situation. All modern hardware is already using the Secure Boot certificate issued in 2023, and those that are not have either disabled Secure Boot without realizing it or use faulty firmware.

You can verify whether Secure Boot is enabled and up to date by opening Windows Security > Device security > Secure Boot.

If it says Secure Boot is on and certificates are applied, you don’t have to worry about anything. But in some cases, it only says “Secure Boot is on,” and there’s no clear indication of the certificates’ current state.

OEMs confirm Secure Boot issues

HP is one of the OEMs that recently confirmed that Secure Boot updates are being accidentally blocked on their PCs. In a support document, HP said it began rolling out an updated BIOS for many PCs to prepare for the Secure Boot deadline in June. Unfortunately, some PCs get stuck at a BitLocker screen, and Secure Boot certificates fail to install.

“Microsoft’s 2023 certificates may fail to properly apply on the computer when this BitLocker issue occurs,” HP noted.

After HP and some other manufacturers informed consumers about potential known issues with Secure Boot, Microsoft also stepped in with an update.

Microsoft says it worked with PC manufacturers and identified a set of devices or firmware where the Secure Boot certificate update could cause trouble. If affected, the devices need a fresh firmware update, but since that is not yet available, Microsoft has blocked Secure Boot certificate updates to reduce risk.

“Devices in this group are affected by a known issue,” Microsoft warns without sharing examples of the affected PCs.

“To reduce risk, Secure Boot certificate updates are temporarily paused while Microsoft and partners work toward a supported resolution. Contact your device manufacturer for assistance.”

This new alert began rolling out recently, so if you’ve been seeing Secure Boot is on, but no clear information about the installed certificate, you should check the Security app again.

“A firmware update is required but might not yet be available. When it becomes available, the firmware update will be released and installed through your OEM’s standard update channel,” Microsoft explained.

Why some PCs are not getting Secure Boot 2023 yet

Microsoft told Windows Latest that most PCs have already received the Secure Boot certificates, and they install automatically through Windows Update.

In some cases, Windows Update detects potential compatibility issues, which is why it never sends the Secure Boot 2023 update your way.

There’s another warning where Windows reports Secure Boot status as on, but also points out that the device will not receive the Secure Boot certificate update due to hardware or firmware limitations.

In the above case, if your device is a few years old and is not one of the OEM’s best-selling units, do not expect an update. OEMs rarely release firmware updates for older PCs, and when the UEFI firmware is not supported, Microsoft won’t release the Secure Boot 2023 certificate update for your PC.

“Many OEMs are actively releasing these firmware updates through their standard update channels. If a firmware update is required, check your OEM’s Secure Boot support page for next steps,” Microsoft noted, and it aligns with our previous findings.

Windows Latest previously found that OEMs have quietly updated their Secure Boot documentation to acknowledge Secure Boot problems and the lack of firmware updates required for necessary security changes.

“Your PC model might no longer be supported by the OEM, or the OEM might no longer be able to provide the firmware updates needed to update your device’s Secure Boot trust configuration,” Microsoft explained in another document.

Why Secure Boot 2023 is required, but it’s not a deal breaker if you don’t have it yet

For those unaware, Secure Boot is a security feature that’s built into your computer’s UEFI firmware and is officially required by Windows 11 unless you bypassed it. When Secure Boot is turned on and certificates are up to date, Windows blocks unauthorized or invalid software and potential malware from running at boot level.

Secure Boot 2011 and the new 2023 certificates are used to process and verify updates to the Secure Boot DBX, also known as the Forbidden Signature Database. Without an updated certificate, a PC cannot securely receive new lists of compromised or vulnerable bootloaders to block.

Microsoft insists that you must not turn off Secure Boot if you are not getting the update, as that would make Windows security worse than it already is without the updated certificates.

As we’ve previously reported, an expired Secure Boot certificate doesn’t mean your PC will stop booting or working. In fact, it’s almost impossible for a casual consumer to notice any difference, and this is not an immediate disaster for most consumers, but Microsoft shared more details in the table below:

At the end of the day, Secure Boot is a “firmware-based boot chain verification mechanism,” and updated certificates are required to ensure PCs only run verified software.

The post Microsoft confirms Secure Boot update failing on some Windows 11 PCs, blocks update due to known issues appeared first on Windows Latest