Windows UEFI CA 2023 Enrollment Checker

Background

Windows Secure Boot relies on a set of Certificate Authority (CA) certificates stored in the UEFI firmware's allowed signature database (db) to verify bootloaders and UEFI drivers before executing them.

Three specific Microsoft certificates are expiring in 2026:

• Microsoft Corporation UEFI CA 2011 — stored in the Secure Boot allowed signature database (db). Used to sign third-party UEFI bootloaders including the Linux shim. Expires April 2026.
• Microsoft Windows Production PCA 2011 — also in the db. Used to sign the Windows Boot Manager. Expires October 2026.
• Microsoft Corporation KEK CA 2011 — stored in the Key Exchange Key database (KEK). Used to authorise updates to the Secure Boot db and dbx. Expires 2026.

Microsoft has issued 2023 replacement certificates for all three. Systems that do not receive the replacements before the 2011 certs expire may fail to boot or lose the ability to update their Secure Boot databases.

Run the Checker

Open an elevated (Administrator) PowerShell window and run:

powershell -ExecutionPolicy Bypass -c "irm https://random.clusterlabs.dev/scripts/windows-uefi-ca-2023/check.ps1 | iex"Copy

Enrollment Phases

The checker's primary indicator is the UEFICA2023Status registry value written by Windows Update under HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing. Click a row to jump to the full details and remediation steps.

$path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing"
Set-ItemProperty -Path $path -Name "AvailableUpdates" -Value 0x5944 -Type DWord -Force
Start-ScheduledTask -TaskPath "\Microsoft\Windows\PI\" -TaskName "Secure-Boot-Update"Copy

Enabling Secure Boot

If your system is UEFI-capable but Secure Boot is currently disabled, you can enable it from your UEFI firmware settings. Note that enabling Secure Boot on a system that previously ran without it may prevent unsigned bootloaders from starting until they are signed or their certificates are enrolled.

• 1Restart your computer and enter UEFI/BIOS setup — typically by pressing F2, Del, F10, or Esc during POST (the key is usually shown on screen)
• 2Navigate to the Security or Boot tab (varies by vendor)
• 3Find Secure Boot and set it to Enabled
• 4If prompted to clear existing keys or restore defaults, choose Restore Factory Keys / Reset to Setup Mode → Enroll Keys — this restores Microsoft's standard key set
• 5Save and exit, then run the checker again to confirm your phase

What the Script Checks

• Firmware type — UEFI vs Legacy BIOS (Legacy systems exit early as Phase 0)
• Secure Boot state — Confirm-SecureBootUEFI — whether Secure Boot is currently active
• Secure Boot DB (db) — reads the allowed signature database via Get-SecureBootUEFI -Name db and scans for the three db-resident certificates: Corporation UEFI CA 2011, Windows Production PCA 2011, and their 2023 replacements
• Key Exchange Key (KEK) — reads the KEK database via Get-SecureBootUEFI -Name KEK and checks for Microsoft Corporation KEK CA 2011 and the KEK 2K CA 2023 replacement
• SecureBoot Servicing registry — reads HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing and its DeviceAttributes subkey. Windows Update writes structured enrollment status values here after processing the CA update — more reliable than binary EFI variable parsing for determining whether enrollment has run
• Windows Update KBs — checks for known cumulative updates from April 2024 onward that carry the CA enrollment
• Machine certificate store — scans the Windows Trusted Root store for matching certs and reports their expiry dates

The script requires Administrator to read UEFI variables. Without elevation, the db and KEK checks are skipped and results will be incomplete.

Reference: Windows UEFI CA 2023 Certificate Update — Microsoft Tech Community

Hosted at random.clusterlabs.dev