This guide is for anyone with a Windows 11 laptop or desktop who has read the news about Secure Boot certificates and wants a plain answer for their own machine. In about ten minutes you will know whether Secure Boot is on, whether the newer 2023 certificate is already installed, and what to do next. You do not need to open the laptop or install anything.
How do I know if my PC has the new Secure Boot certificates?
Short answer: Press the Windows key and R, type msinfo32 and check that Secure Boot State says On. Then run one short PowerShell line, shown below, to see whether the newer 2023 Microsoft certificate is present. If it is, you are done. If it is not, keep Windows Update running and the laptop plugged in, and do not switch Secure Boot off.
What is changing, and when?
Secure Boot (a start-up safety check that lets only trusted software load before Windows) relies on digital certificates, which work like ID cards with an expiry date. Microsoft issued the original set in 2011 and is now replacing it with newer 2023 certificates. Microsoft explains the rollout in its support article on Secure Boot certificate updates. The 2011 certificates expire in two windows.
The two June dates have already passed. The one now in the news is 19 October 2026. We are not predicting what happens to a PC that has not yet received the new certificates. This guide only shows how to check and how to stay safe while you do.
Step 1: Is Secure Boot switched on?
- Press the Windows key and R together, type msinfo32 and press Enter.
- On the System Summary page, find BIOS Mode and Secure Boot State.
- BIOS Mode should read UEFI and Secure Boot State should read On.
If it reads Off or Unsupported, change nothing yet and read the help section below. Do not turn Secure Boot off to make a warning go away; it removes a protection and can also bring up a BitLocker recovery screen.
Step 2: Look for the 2023 certificate
Option A: the Windows Security app
Open Windows Security, choose Device security and look at the Secure boot section. Some recent versions of Windows show a certificate status or a notice there. The wording differs between versions and older builds show nothing, so a blank screen is not a verdict.
Option B: one PowerShell line
Right-click the Start button and choose Terminal (Admin) or Windows PowerShell (Admin). Paste the line below and press Enter. It is the commonly shared check and it only reads information; it changes nothing.
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
The answer True means the 2023 certificate is already stored on your PC. False means it has not arrived yet. An error message can mean Secure Boot is off or the PC starts in an older mode, so go back to Step 1.
Step 3: Protect your files first
Microsoft lists a BitLocker recovery prompt as a known case after the replacement certificates arrive on some PCs. BitLocker (Windows' built-in drive lock) then asks for a 48-digit recovery key before it opens your files. Save your BitLocker recovery key somewhere other than the laptop before updates arrive.
- If you sign in with a Microsoft account, the key is often saved to that account. Sign in on your phone and look for it.
- Look under Settings, Privacy and security, Device encryption (or Manage BitLocker). The wording can differ slightly between versions.
- Write the key on paper and keep it away from the laptop bag.
If a recovery screen has already appeared and you have no key, read our BitLocker drive recovery guide before you try anything.
What if the 2023 certificate has not arrived?
- Open Settings, Windows Update, choose Check for updates and restart when asked.
- Keep the charger plugged in for the whole update.
- Look at your laptop maker's support page for a BIOS update (the small program that starts the laptop before Windows loads). Our guide to updating a laptop BIOS safely shows the steps. Do not switch the laptop off while a BIOS update is running.
- Do not download tools that promise to fix Secure Boot from messages or videos.
If you are unsure how to open the BIOS screen, see how to enter BIOS on any laptop.
Power cuts and certificate updates
Power cuts and voltage dips are the real practical risk. A firmware or start-up update that is cut off halfway can leave a laptop that will not start, so keep the charger connected, and use a UPS (a small battery backup) for a desktop. Patchy broadband matters too: let large updates finish on a steady connection rather than pausing them on a weak mobile hotspot. If your laptop will not start at all, we accept laptops by courier from anywhere in India.
When to get help
Stop and ask a technician if any of these happen.
- A BitLocker recovery screen appears and you do not have the key.
- The laptop restarts again and again after an update and never reaches Windows.
- A BIOS update was interrupted by a power cut or a restart.
- Secure Boot shows Off on a laptop where you never changed it.
Our BIOS repair and update service handles these cases. In Hyderabad we can visit you through our doorstep service. The charge is ₹149 doorstep visit fee, waived when you approve laptop repair with us.
A note from the LRW Engineer Team
Do three simple things this week. Write down your BitLocker key, keep the laptop on its charger, and run Windows Update once. Then run the check above and leave the machine alone if everything looks normal. Forcing a fix with an untested tool is riskier than waiting for the official update to arrive.