What fixed it wasn't a Windows trick. It was a firmware update. Her story is worth a close look in 2026, a year in which Microsoft's Secure Boot certificate transition is putting long-ignored firmware databases in front of ordinary PC owners.
What happened, and how it got fixed
Yee's account is short. The laptop refused to start Windows and showed the invalid-signature error instead. The usual online answer is "disable Secure Boot." That wasn't an option on this machine.
From her earlier work on Secure Boot, she guessed that outdated certificates were the problem. She went to the manufacturer's support site (PCWorld's images point to ASUS) and downloaded the latest UEFI/BIOS package. The site showed no release notes. Only after unzipping the download could she read what it changed: "Add DB keys Windows UEFI CA 2023 & Microsoft UEFI CA 2023."
She checked three times that the support page matched her exact model, copied the file to a USB drive, went into the firmware setup and ran the update. After the flash, the laptop booted into Windows normally.
Some limits on what we know:
- PCWorld doesn't name the laptop model or the BIOS version.
- There is no diagnosis from the manufacturer. The certificate theory is Yee's informed guess, and the fix fits it, but that doesn't prove the cause.
- Yee says the laptop gave her no warning about its Secure Boot status beforehand.
- She also says a different PC of hers was approved for the certificate update and then had that approval withdrawn because of a conflict. That machine is still waiting.
Section summary: a Windows laptop that wouldn't boot, Secure Boot controls locked, and a BIOS update that added the 2023 Microsoft certificates. Whatever the exact root cause, the update fixed it.
Why certificates are suddenly a thing you have to care about
Secure Boot is a UEFI firmware feature. Before anything starts, it checks the signature on pre-boot code (boot loaders, option ROMs, EFI applications) against trusted certificates stored in the firmware. If the firmware doesn't trust a signature, that code doesn't run. This is the protection against bootkits.
The certificates most Windows PCs have carried since Windows 8 are now expiring. According to Microsoft's KB5062710 certificate table:
| Expiring certificate | Expiration date | Replacement | Stored in | Purpose |
|---|---|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 | KEK | Signs updates to DB and DBX |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 | DB | Third-party boot loaders, EFI apps |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft Option ROM UEFI CA 2023 | DB | Third-party option ROMs |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 | DB | Signs the Windows boot loader |
The two certificates named in Yee's BIOS notes, Windows UEFI CA 2023 and Microsoft UEFI CA 2023, are both DB entries from this table. The last 2011 certificate expired on October 19, just weeks before her lockout. That timing is suggestive, but it doesn't prove anything.
Microsoft is clear that expiry alone shouldn't stop a PC from booting. Devices that haven't received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install. What those devices lose is future early-boot protection: new Boot Manager updates, DBX revocations and fixes for newly found boot-level flaws.
So why would a laptop suddenly refuse to boot? Microsoft's documentation describes two failure paths, and ASUS's own support pages describe the first one too.
Two ways the transition can actually brick a boot
1. Secure Boot reset to firmware defaults after the update. Suppose Windows has already moved to a boot manager signed by Windows UEFI CA 2023. Then something (a user, a firmware action, a CMOS reset) puts Secure Boot back to factory defaults that don't include the 2023 certificate. Now the firmware no longer trusts the boot manager. ASUS puts it directly: "If Windows is already utilizing the 2023-signed Boot Manager, but the firmware is reset to defaults that do not include the Windows UEFI CA 2023 certificate, Secure Boot will block the boot process." Microsoft's troubleshooting guide says this failure comes from the later firmware action, not from the certificate update itself.
2. Firmware that overwrites the DB instead of adding to it. Microsoft says some firmware wrongly replaces the whole Secure Boot DB when Windows adds new certificates. That wipes out the 2011 certificate. If the PC is still using a 2011-signed boot manager at that point, the firmware rejects it.
Dell's guidance explains why a BIOS flash in particular can help. As Notebookcheck summarized it, Dell's Secure Boot Transition FAQ distinguishes between the Active Secure Boot database (what the system actually enforces at boot, and what Windows Update commonly modifies) and the Default Secure Boot database (the factory reset set, typically updated via BIOS flashing). Lenovo describes its fix the same way: a BIOS update that adds the 2023 certificates into the default Secure Boot variables.
In short, Windows Update can change the certificates the firmware currently enforces, but only a firmware update changes the factory defaults. If the active database loses its 2023 entries and falls back to old defaults, only new firmware brings the 2023 entries back permanently. We don't know whether that's exactly what happened to Yee's laptop. It is a plausible explanation for why her fix worked.
Section summary: expired certificates alone shouldn't stop a boot. Mismatches between the boot manager's signature and what the firmware trusts can. OEM firmware updates are what put the 2023 certificates into the factory defaults.
If your PC still boots: check now, not later
The easiest time to deal with this is while Windows still starts.
- Open Windows Security. Microsoft calls it the easiest way to see whether your Secure Boot certificates are current or whether you need a firmware update from the manufacturer. If it says updates are paused because of a known issue, or that your hardware or firmware can't take the automated update, Microsoft sends you to your OEM's Secure Boot support page.
- Check the DB directly. In an elevated PowerShell window, ASUS's guidance uses this command:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'. If "True" appears, it means "Windows UEFI CA 2023" is included. Run it again with 'Microsoft UEFI CA 2023' to check the third-party CA. - Make sure the servicing task is alive. Microsoft says the
\Microsoft\Windows\PI\Secure-Boot-Updatescheduled task runs as Local System at startup and every 12 hours after that. If it's disabled or missing, certificate updates can't happen. - Admins: read the registry and event log. Under
HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot, look atUEFICA2023Status,UEFICA2023Error,UEFICA2023ErrorEventandAvailableUpdates, then compare them with Secure Boot events in the System log. Microsoft says a finalAvailableUpdatesvalue of 0x4000 means every applicable step finished. - Install the latest BIOS from your OEM anyway. If the new firmware's factory defaults already include the 2023 certificates, a later Secure Boot reset can't lock you out the way the first failure path does.
Some older hardware won't get that firmware. An ASUS moderator said that BIOS 2101 for the ROG Strix Z390-E Gaming does not include the 2023 Microsoft Secure Boot certificates embedded in firmware, and that ASUS is not expected to release a new BIOS update for Z390-series boards specifically to integrate the 2023 Microsoft Secure Boot certificates. Yee was right to feel lucky that her laptop had an update.
If you're already staring at "Invalid signature detected"
There's no single fix. Match the symptoms to the scenario before you change anything.
- Yee's route (firmware update): On a working computer, find your exact model on the manufacturer's support site. Download the latest UEFI/BIOS package, open the release notes and look for DB keys or 2023 certificates. Copy the file to USB and run it with the firmware's built-in flash tool, following your OEM's instructions. Flashing a file meant for a different model is far worse than a boot error.
- Failure after a Secure Boot reset (Microsoft's recovery utility): On a second Windows PC with the July 2024 or newer update installed, copy
SecureBootRecovery.efifromC:\Windows\Boot\EFI\. Put it on a FAT32 USB drive as\EFI\BOOT\bootx64.efiand boot the affected PC from that drive. Microsoft says the utility adds Windows UEFI CA 2023 to the DB. It restores only that one certificate, so afterward reapply the full certificate set and install the newest OEM firmware. - Failure right after a certificate update (DB overwrite): Microsoft suggests resetting Secure Boot settings in firmware setup. If the PC then boots, install the OEM firmware that fixes DB handling before you turn Secure Boot back on and reapply the certificate updates. If the reset doesn't bring the PC back, you need guidance specific to your manufacturer.
- About turning Secure Boot off: Microsoft says disabling Secure Boot isn't recommended because it reduces protection. Yee's grayed-out settings show it may not even be possible. At most, treat it as a temporary diagnostic step, never as the fix.
The bigger picture: who's actually in charge here?
Yee is frustrated, and she has reason to be. She describes Microsoft warning that new certificates were coming while nobody fully took charge, then Microsoft stepping in at the last minute. Her verdict is that Windows 11 doesn't feel "effortless, modern, and secure" right now.
Microsoft would answer that the system is working as designed. Only the OEM can authorize changes at the root of trust, which is the whole point of Secure Boot. Most PCs got the certificates automatically through Windows Update. Windows Latest reported in June that HP, Dell, ASUS, and Lenovo have published dedicated Secure Boot 2023 certificate update guides for their devices.
Both sides have a point. The design is sound, but it leaves gaps that ordinary users fall into:
- Release notes that only make sense to experts. "Add DB keys Windows UEFI CA 2023" means nothing to most people, and on Yee's support site you couldn't even read it until after downloading.
- Devices that sit unused. A laptop that's been in a drawer misses scheduled tasks, reboots and firmware prompts, then wakes up into a very different trust environment.
- Approvals that get pulled back. Yee's second PC, approved and then held back, shows that rollout status can change.
Bottom line: if you have a laptop that hasn't been switched on for a while, boot it now, check Windows Security, run the PowerShell DB check and install any pending BIOS update from the manufacturer's official support page. Doing that while Windows still starts is much easier than recovering from a USB stick after it won't. And if a forum post tells you to just turn Secure Boot off, keep in mind it may not be possible on your machine, and it doesn't fix the underlying problem.