Unsolved
3 Novice
•
184 Posts
•
627 Points
2
2651
May 19th, 2026 14:58
Work-around: How to install Secure Boot Certificates because Dell won't update them in older computers
Because Dell won't update the UEFI Secure Boot Certificates in older computers example: R9, R10, etc. there is a work around to manually install them:
First check and see if the "Windows UEFI CA 2023" have already been installed:
Run Powershell as Amin and type:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
You will see a True or False Result:
PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
True
If it says True, you are done and are good to go.
If it says False, Example:
PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
False
You will need to manually deploy the 2023 certificates:
Run Powershell as Admin and Type:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
After that is done Type exit to close Powershell and reboot twice...
Remember you need to REBOOT TWO TIMES!
After rebooting 2 times run Powershell as Admin and type:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
If everything went well you should see True:
PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
True
Note:
Caveats -
** This only updates the ACTIVE Secure Boot Certificate Database.
** It does NOT update the Secure Boot BACKUP Database so AVOID RESET of the Secure Boot Certificates when in UEFI BIOS.
**** Also it DOES NOT update the KEK (Key Exchange Key) Database that authorizes updates to Secure Boots Certificates, so if/when Microsoft updates them again, say for a new threat or in the 2030s decade you may need to manually deploy any updated Secure Boot Certificates again!
hampal
1 Rookie
•
2 Posts
•
7 Points
0
May 25th, 2026 16:33
Is there a similar manual update for Linux? My PC was too old for Windows 11 so I switched to Linux Mint in October 2025.
sm56
3 Novice
•
184 Posts
•
627 Points
0
May 25th, 2026 17:41
You can try:
**************** Check Secure Boot Certs in UEFI Firmware on Linux *****************
sudo mokutil --kek
sudo mokutil --db
***************************************************************************
--------------- Check and install UEFI Firmware Updates on Linix ---------------------------------------------------------
sudo fwupdmgr refresh --> Checks if firmware is up to date
sudo fwupdmgr get-updates --> Displays what updates are available for firmware devices
sudo fwupdmgr update --> Updates firmware for devices where firmware updates are available
---------------------------------------------------------------------------------------------------------------------------------------------------------
Also watch this on Youtube as it goes over BOTH Linux & Windows:
https://www.youtube.com/watch?v=_AwzaZmRNsI&t=1s
(edited)
mike2084
1 Rookie
•
3 Posts
•
7 Points
0
June 3rd, 2026 13:23
This worked for me on a Alienware R12 to update the boot cert to 2023. Note though that this doesn't update the notification in Windows Security which will still read that Secure Boot is on, but your device does not support the automated Secure Boot update due to hardware or firmware limitations and to contact your manufacturer for further assistance. I imagine this can be changed by updating a registry value but that's beyond me. Hopefully we will get a BIOS update at some stage for the R12 as this machine is not even 4 years old since purchase.
sm56
3 Novice
•
184 Posts
•
627 Points
1
June 3rd, 2026 13:48
@mike2084 Your getting the message because the work-around does NOT update the KEK. That is something that Dell needs to do in a BIOS/UEFI Update but they don't.
BrandsHatch
1 Rookie
•
4 Posts
•
10 Points
0
June 15th, 2026 10:17
The check script didn't work for me on Latitude 5580 running Win 10. The term 'Get-SecureBootUEFIdb' is not recognised as the name of a cmdlet, function, script file or operable program.
MSwift305314
1 Rookie
•
1 Message
•
5 Points
0
June 21st, 2026 21:22
As feedback, this sequence does not update the keys on an XPS One 2710. The scheduled task completes successfully and resets the registry value to 0, but reboots do not update the keys. I have Secure Boot off in BIOS at this time, because enabling it causes boot failure with message from BIOS that keys are wrong (presumably out of date for latest Windows 10).