#securebootdb — Public Fediverse posts

Secure Boot Allowed Signature Database update begins rolling out for Windows 11 users!

As we are very close to the expiry date of the old Secure Boot signatures for Windows in June 2026, both Microsoft and computer manufacturers have started taking steps to ensure that everyone gets updated to the newer Secure Boot signatures prior to the expiry of the old signatures.

The following signatures are set to expire:

• Microsoft Corporation KEK CA 2011: June 2026
• Microsoft Windows Production PCA 2011: October 2026
• Microsoft UEFI CA 2011: June 2026

The new certificates, which will replace the above ones, will be used on your computer:

• Microsoft Corporation KEK 2K CA 2023
• Windows UEFI CA 2023
• Microsoft Option ROM UEFI CA 2023

Since the Secure Boot certification expiry topic has been brought up, BIOS updates have been done in order to prepare the computer for the new Secure Boot certification. Now, we have spotted a new update that updates the Secure Boot Allowed Signature DB to include the new certificates. The update will require your computer to restart.

Your computer should be able to update the Secure Boot database by itself, but you’ll need to restart your computer to finish installing the new Secure Boot database. It will take at least 2 minutes to install the updated database.

After that, Windows Security should say that you have no pending Secure Boot updates available. To verify, open Windows Security, navigate to Device Security, and look for Secure Boot. If everything is successful, you should be able to see:

If your device didn’t get the secure boot database update, wait for a few days, or check for updates using Settings > Windows Update > Check for Updates. Please note that old devices may not get the Secure Boot database update.