How to Fix Windows 11 Secure Boot Certificate Update Failed?

Microsoft is replacing older Secure Boot certificates issued in 2011 with newer 2023 certificates. The original certificates began reaching their expiration dates in June 2026. Most personal computers receive the replacement certificates automatically through Windows Update, but firmware limitations, BitLocker conflicts, and servicing errors can prevent the process from completing.

Your computer may continue starting normally and receiving regular Windows updates even when the certificate update has failed. However, it could miss future security protections for Windows boot components.

I recommend checking the actual update status and identifying the error before changing anything in UEFI firmware. The following steps will help you determine whether the problem is with Windows, BitLocker, or your computer’s firmware.

Check Your Secure Boot Certificate Status First

Windows 11 now provides additional information about Secure Boot certificate updates through the Windows Security app.

To check it:

1. Open the Start menu and search for Windows Security.
2. Select Device security.
3. Find and open Secure Boot.
4. Read the status message displayed on the page.

Depending on your computer, you may see one of several messages.

• Fully updated: All required certificates have been applied, and the updated Windows Boot Manager has been installed. No further action is necessary.
• Not yet updated: Your PC is still using an older Secure Boot configuration. Install the latest Windows updates and restart when prompted.
• Temporarily paused: Microsoft has identified a known compatibility issue affecting your device. The update should resume when a supported resolution becomes available.
• Hardware or firmware limitation: Your computer cannot currently complete the automated update because of a platform limitation. Contact the manufacturer.
• Requires action: Your current boot configuration cannot receive a required security update. Follow Microsoft’s instructions at aka.ms/getsecureboot.

One detail matters here: a green checkmark alone does not prove that the new certificates have been installed. Read the accompanying message. You want to see that all required certificate updates have been applied.

Microsoft is rolling out these status indicators gradually, so the exact display can differ between computers.

1. Install the Latest Windows Updates

Start with Windows Update because Microsoft distributes the replacement Secure Boot certificates through its servicing process.

1. Press Windows + I to open Settings.
2. Select Windows Update.
3. Click Check for updates.
4. Install the applicable updates.
5. Restart your computer if Windows requests it.
6. Return to Windows Update and check again.

Some certificate updates require the computer to restart before the next stage can complete. Keep the computer connected to the internet and allow the update process time to run.

If your PC is managed by your workplace or school, the organisation’s update policies may control when these certificates are deployed. Contact the administrator if you cannot install the required updates.

2. Confirm That Secure Boot Is Actually Enabled

A certificate-update problem is different from Secure Boot being disabled.

Windows needs to be running through a compatible UEFI environment, with Secure Boot enabled, for the certificate servicing process to work as expected.

You can check this without entering BIOS.

1. Press Windows + R.
2. Type msinfo32 and press Enter.
3. Find BIOS Mode in System Summary.
4. Check Secure Boot State.

For a normal active configuration, you should see:

BIOS Mode: UEFI
Secure Boot State: On

If BIOS Mode says Legacy or Secure Boot State says Unsupported, you have a separate boot configuration problem.

Do not simply switch from Legacy to UEFI or change the Secure Boot keys to force the certificate update. A Windows installation configured for Legacy boot may stop starting if you change firmware modes without preparing the system disk.

I have separate guides for these situations:

• Secure Boot Enabled but Not Active? How to Fix It
• Secure Boot State Unsupported? How to Fix It

If System Information already reports UEFI and Secure Boot State: On, leave those settings alone and investigate the certificate-update error.

3. Identify the Secure Boot Error in Event Viewer

Event Viewer can tell you why Windows could not apply a certificate or firmware update.

To check the relevant events:

1. Right-click Start and select Event Viewer.
2. Expand Windows Logs.
3. Select System.
4. Choose Filter Current Log.
5. Look for the TPM-WMI event source, if available.
6. Check for Secure Boot events such as 1032, 1033, 1795, 1799, 1800, 1801, 1802, and 1803.

Pay particular attention to the following errors.

Event ID 1032: BitLocker configuration conflict

This event means that the current BitLocker configuration could cause Windows to enter recovery mode when applying the Secure Boot update.

Microsoft’s documented resolution is to temporarily suspend BitLocker protection for two restart cycles.

Before doing this, make sure you can access your BitLocker recovery key.

Open Command Prompt as administrator. If you use Windows Terminal, select a Command Prompt tab before running the following commands. The %systemdrive% syntax shown here is for Command Prompt, not PowerShell.

manage-bde -protectors -disable %systemdrive% -RebootCount 2

Restart the computer twice to allow the update to complete.

After the two restarts, open Command Prompt as administrator again and run:

manage-bde -protectors -enable %systemdrive%

This procedure is specifically for the Event ID 1032 BitLocker conflict. Do not suspend BitLocker as a general fix for unrelated Secure Boot errors. Microsoft describes the procedure in its Secure Boot event guidance.

Event ID 1795: Firmware returned an error

Event ID 1795 means your computer’s firmware returned an error while Windows was attempting to update a Secure Boot variable.

The affected component may be the Secure Boot database (DB), the revoked signature database (DBX), or the Key Exchange Key (KEK).

This usually requires checking firmware compatibility.

What I recommend:

1. Identify your exact computer or motherboard model.
2. Visit the manufacturer’s official support website.
3. Check whether a newer BIOS or UEFI firmware version is available.
4. Read the release notes for relevant security or Secure Boot fixes.
5. Follow the manufacturer’s firmware-update instructions if an applicable update is available.

Do not install firmware intended for a different model. Also, make sure you have your BitLocker recovery key before updating BIOS.

Event ID 1800: A restart is required

Event ID 1800 indicates that Windows needs another restart before it can safely apply a Secure Boot update.

Save your work and restart Windows normally. Check Event Viewer again after the restart to see whether the update progresses.

Repeatedly changing Secure Boot settings is unnecessary when this event simply indicates that a restart is pending.

Event ID 1801: Secure Boot certificates have not been applied

Event ID 1801 indicates that the Secure Boot certificate update has not yet been fully applied to your device.

It is an important incomplete-update indicator, but it does not always identify the underlying cause by itself.

Check for other Secure Boot events around the same time. In particular, look for Event ID 1795, 1802, or 1803, which can provide more specific information about firmware or platform limitations.

If the related events point to firmware compatibility, check for an update from your computer manufacturer.

Event ID 1802: Update intentionally blocked

Event ID 1802 means Microsoft has intentionally blocked the update because your device matches a known hardware or firmware condition that could make the installation unsafe.

This is not necessarily a problem you can fix by changing a Windows setting.

Do not force the certificate update, clear Secure Boot keys, or use an unofficial registry workaround. Check Windows Security for the current status and wait for Microsoft’s supported resolution.

Event ID 1803: Required OEM key is missing

Event ID 1803 means Windows cannot find the manufacturer-signed Key Exchange Key required to complete the update on your device.

Secure Boot certificate installation depends partly on keys supplied and authorised by the computer manufacturer.

Contact the manufacturer and ask whether the required Secure Boot key provisioning is available for your exact model.

Changing Windows registry values will not create the missing manufacturer-signed key.

Event ID 1799: Boot manager update succeeded

Event ID 1799 is a successful event, not a failure.

It indicates that Windows installed a boot manager signed with the Windows UEFI CA 2023 certificate.

Seeing this event is a useful sign of progress, although you should still check the overall certificate status before assuming every update stage has completed.

4. Check the Secure Boot Update Registry Status

Windows also records certificate servicing information in the registry.

You can inspect these values without changing them.

1. Press Windows + R.
2. Type regedit and press Enter.
3. Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

Look for the following values:

• UEFICA2023Status
• UEFICA2023Error
• UEFICA2023ErrorEvent

The status value can help you understand how far the update has progressed.

• NotStarted means the update process has not started.
• InProgress means Windows is still processing the update.
• Updated means the required update process has completed.

If UEFICA2023Error contains a non-zero value, Windows has recorded an error. The UEFICA2023ErrorEvent value can identify the corresponding event ID in Event Viewer.

Do not manually change these values to Updated or delete the registry entries. They are diagnostic information, not switches that independently install Secure Boot certificates.

If the registry key is missing, that alone does not prove your computer is damaged. The servicing process may not have started.

5. Check Whether the Secure Boot Update Task Is Running

Windows uses a scheduled task to process Secure Boot certificate updates.

When the task is disabled or missing, the update process may not make progress.

To inspect it:

1. Press Windows + R.
2. Type taskschd.msc and press Enter.
3. Expand Task Scheduler Library.
4. Open Microsoft.
5. Select Windows.
6. Open the PI folder.
7. Look for Secure-Boot-Update.

The task should be enabled. Microsoft documents that it normally runs at startup and every 12 hours.

If the task is missing or disabled, do not download a random replacement script or recreate it using instructions intended for a different Windows installation. Follow Microsoft’s current troubleshooting guidance or contact support for help restoring the system task.

6. Install a Compatible BIOS or UEFI Firmware Update

Some Secure Boot certificate failures cannot be resolved through Windows Update alone.

Windows coordinates the certificate update, but your computer’s firmware is responsible for storing and applying the Secure Boot keys and databases.

An outdated or incompatible firmware implementation can reject the update.

I recommend checking the manufacturer’s support page for your exact device.

Before updating BIOS:

• Confirm the full model number.
• Download firmware only from the official manufacturer.
• Read the release notes and installation instructions.
• Connect the laptop to its power adapter.
• Back up important files.
• Make sure you have your BitLocker recovery key.

Do not reset Secure Boot to factory defaults or clear the Secure Boot keys simply because the certificate update failed. Some firmware resets can remove trust certificates needed by the updated Windows boot manager and prevent Windows from starting.

For HP computers, my guide to recovering an HP BIOS update that is stuck explains important precautions when working with firmware.

For MSI motherboards, see How to Enable Secure Boot in MSI Click BIOS 5.

What If BitLocker Recovery Appears After the Secure Boot Update?

A BitLocker recovery prompt after a Secure Boot update does not automatically mean the update has damaged Windows.

Microsoft documents two situations worth distinguishing.

The recovery prompt appears once: Firmware may temporarily report different Secure Boot values during the first restart after the update. Enter your recovery key to start Windows. If subsequent restarts work normally, the prompt was likely a temporary measurement mismatch.

The recovery prompt appears after every restart: Check your firmware boot order. Microsoft documents a situation where a computer tries PXE network boot before the local Windows boot manager. The different boot trust paths can cause BitLocker to request recovery repeatedly.

If you do not use network boot, set Windows Boot Manager as the first boot option and disable PXE boot if your manufacturer provides that option.

If your organisation requires PXE boot, its IT administrator may need to ensure that the network boot infrastructure uses a compatible 2023-signed Windows boot loader.

Do not clear the TPM or reset Secure Boot keys to get past a recurring BitLocker prompt. Those actions can make recovery more difficult.

When You Should Contact Your PC Manufacturer

Some Secure Boot certificate update failures are caused by firmware limitations or missing manufacturer-provided keys. Windows cannot independently correct those conditions.

Contact your manufacturer if:

• Event ID 1795 keeps appearing after installing applicable firmware updates.
• Event ID 1803 reports that the required PK-signed KEK is missing.
• Event ID 1802 shows that the update is blocked for your hardware or firmware.
• Windows Security says your device does not support the automated certificate update.
• The certificate update remains incomplete despite the latest Windows updates and the recommended troubleshooting steps.

You should also follow Microsoft’s Secure Boot troubleshooting guide and Secure Boot certificate update guidance for the latest supported instructions.

The most important thing is to identify what is preventing the update before changing firmware settings. A BitLocker conflict, an unsupported firmware configuration, and a missing OEM key are different problems. Applying the correct fix for the actual error is safer than repeatedly changing Secure Boot settings and hoping Windows will accept the update.