Microsoft’s 2023 Secure Boot Certificates update
In Secure boot the DBX is a revocation list saying don’t trust such certificates. If you add stuff to their older certificates won’t work. In 2026 Microsoft emphasied. That they were not going to be adding the old 2011 certs to the DBX block list. For now it’s a push to make secure boot work with 2023 Certs. Also Windows update would only update fully if your bios supported it. So you had to also update your BIOS to a version that would support the change. Your older computers would still boot and work they just would not get future secure boot updates.
Some IT departments actually started adding DBX revocations to unsupported computers. Which is a big no no. You are better off replacing your computers to versions that support newer certs. Just because you add a 2011 certificate revocation to DBX. Does not mean you are protected against future rootkit attacks. They would follow guides such as this one https://support.microsoft.com/en-us/servicing/os/secure-boot/2020/12/microsoft-guidance-for-applying-secure-boot-dbx-update-kb4575994 Which lead to more problems with booting and computers not working well. The only good way is to update your Bios to a version that supports 2023 certs. If you bios is too old then you really only have one choice which is to replace your computers.
Checking that link today it looks like Microsoft even deprecated that article saying feature updates will take care of that stuff in the future. For now Microsoft is not adding updates to the DBX. Eventually it will happen might be in a year or couple years. But the timeline is to eventually make it so only 2023 and newer certs work with secure boot. Windows 11 may not ever get the DBX. Might be something introduced in Windows 12 where you can only boot with 2023 and newer secure boot certificates. Microsoft has said computers that don’t support 2023 won’t be receiving the updates, and won’t have the DBX updates applied. They will still be able to boot. You just won’t get newer security updates for secure boot area. The computer will still get other security and feature updates.
Since it was such a big deal Microsoft did a ask Microsoft event on the secure boot change. here’s a link to that event https://techcommunity.microsoft.com/event/windowsevents/ask-microsoft-anything-secure-boot---june-2026/4522056
Secure Boot relies on several firmware databases:
- PK (Platform Key): Establishes platform ownership and controls changes to Secure Boot policy.
- KEK (Key Exchange Key): Authorizes updates to Secure Boot signature databases.
- db (Allowed signatures): Contains certificates and hashes trusted for booting.
- dbx (Forbidden signatures): Contains revoked certificates and hashes that must not be allowed to boot.
A quick recap of what issues will occur if you manually do DBX updates. May end up revoking vulnerable bootloaders signed by the old Windows Production PCA 2011 certificate. Older UEFI implementations can mishandle database updates. If your firmware trusts only the older 2011 certificates, manually installing a newer DBX does not automatically add the 2023 certificates needed for the transition. DBX update doesn’t update PK, KEK, or DB. Which usually requires a Bios firmware update or a computer that already is running with newer Bios supporting 2023 certs. You could end up with a system that has new revocations but lacks the updated trust configuration needed for future boot components.
Get Ruben’s stories in your inbox
Join Medium for free to get updates from this writer.
Let’s say you actually did do a DBX manual update. You now can have such serious issues shown below.
- No newer BIOS update from the manufacturer or BIOS update causes a crash.
- Firmware that cannot properly handle the new certificate configuration.
- BitLocker recovery prompts after changes to the boot environment.
- No usable recovery USB because its bootloader is also affected by the revocation.
As of now you shouldn’t even be following guides to do manual DBX updates. Probably why Microsoft retired that one article link. People kept causing more problems by manually doing DBX update. Also there are guides on manually applying the 2023 certs. If your BIOS doesn’t support 2023 certs then there is no point in manually applying the updates. You will still be vulnerable to rootkits. Microsoft can’t update areas of your bios to support 2023 certs. That is up to your computer manufacturer. Some of them aren’t even releasing BIOS updates for some older models. If you don’t have secure boot on then none of this even applies to you. Your computer will still boot and function. However having secure boot off exposes you to sever security risks. Most likely Microsoft will make the next Windows to be secure boot only, with no 2011 certificate support. In those case you won’t be able to install with secure boot off. But we will see they haven’t released any date for a Windows 12 release.
To find out if your computer gets the Bios update refer to the manufacturers guides. For Lenovo computers the link is https://support.lenovo.com/us/en/solutions/ht518129 While this link is for HP business computers https://support.hp.com/us-en/document/ish_13070353-13070429-16
