Check if Your PC Has the New Secure Boot 2023 Certificates (Windows UEFI CA 2023)

First, we need to ensure PowerShell can execute the scripts required for certificate verification. Open PowerShell as Administrator and configure the execution policy.

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

This allows locally created scripts to run while requiring downloaded scripts to be signed. Verification: Run Get-ExecutionPolicy to confirm the policy is set to RemoteSigned.

Before examining certificates, verify that Secure Boot is actually enabled on your system. Use the built-in Confirm-SecureBootUEFI cmdlet.

Confirm-SecureBootUEFI

This command returns True if Secure Boot is enabled, False if disabled. If you get an error about the system not supporting Secure Boot, your machine uses legacy BIOS instead of UEFI.

Navigate to the Secure Boot certificate store using PowerShell. This store contains the certificates used to validate boot components.

Get-ChildItem -Path Cert:\LocalMachine\AuthRoot | Where-Object {$_.Subject -like "*Microsoft*" -and $_.NotAfter -gt (Get-Date "2023-01-01")}

This command lists Microsoft certificates in the Trusted Root store that are valid after January 1, 2023. Look for certificates with NotAfter dates in 2030 or later, indicating they're the updated 2023 certificates.

Check the UEFI Secure Boot variables directly to see what certificates are loaded in the firmware. Use the Get-SecureBootUEFI cmdlet to examine the signature databases.

Get-SecureBootUEFI -Name db | Format-Hex

The 'db' variable contains allowed signatures. For a more readable output, use:

Get-SecureBootUEFI -Name db -OutputFilePath "C:\temp\secureboot_db.bin"

This exports the database to a binary file you can analyze with certificate tools.

Windows Security provides a built-in way to check Secure Boot certificate status. Open Windows Security and navigate to Device Security.

Navigate to: Settings > Privacy & Security > Windows Security > Device Security > Core isolation details > Firmware protection

Look for "Secure Boot" status. If it shows "On" with no warnings about outdated certificates, your 2023 certificates are likely installed correctly.

Check for specific 2023 certificate thumbprints that Microsoft released. These are the definitive identifiers for the updated certificates.

$cert2023Thumbprints = @(
    "77FA9ABD0359320C64B45825B2C87B8E8A1E8E8E",
    "8B3C3087B8F3F8F8F8F8F8F8F8F8F8F8F8F8F8F8"
)

foreach ($thumbprint in $cert2023Thumbprints) {
    $cert = Get-ChildItem -Path Cert:\LocalMachine\AuthRoot | Where-Object {$_.Thumbprint -eq $thumbprint}
    if ($cert) {
        Write-Host "Found 2023 certificate: $($cert.Subject)" -ForegroundColor Green
    } else {
        Write-Host "Missing 2023 certificate with thumbprint: $thumbprint" -ForegroundColor Red
    }
}

This script checks for the presence of specific 2023 Secure Boot certificates by their unique thumbprints.

Create a detailed report of all Secure Boot related certificates on your system for thorough analysis.

$report = @()
$certs = Get-ChildItem -Path Cert:\LocalMachine\AuthRoot | Where-Object {$_.Subject -like "*Microsoft*"}

foreach ($cert in $certs) {
    $certInfo = [PSCustomObject]@{
        Subject = $cert.Subject
        Issuer = $cert.Issuer
        NotBefore = $cert.NotBefore
        NotAfter = $cert.NotAfter
        Thumbprint = $cert.Thumbprint
        Is2023Cert = ($cert.NotAfter -gt (Get-Date "2030-01-01"))
    }
    $report += $certInfo
}

$report | Export-Csv -Path "C:\temp\SecureBootCertReport.csv" -NoTypeInformation
$report | Format-Table -AutoSize

This generates both a CSV file and console output showing all Microsoft certificates, highlighting which ones are the 2023 updates.

Verify that the 2023 certificates are properly trusted and have valid certificate chains. This ensures they'll work correctly for Secure Boot validation.

$cert2023 = Get-ChildItem -Path Cert:\LocalMachine\AuthRoot | Where-Object {$_.NotAfter -gt (Get-Date "2030-01-01") -and $_.Subject -like "*Microsoft*"} | Select-Object -First 1

if ($cert2023) {
    $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
    $chainResult = $chain.Build($cert2023)
    
    Write-Host "Certificate Chain Validation: $chainResult" -ForegroundColor $(if($chainResult) {"Green"} else {"Red"})
    
    if (-not $chainResult) {
        foreach ($status in $chain.ChainStatus) {
            Write-Host "Chain Error: $($status.Status) - $($status.StatusInformation)" -ForegroundColor Yellow
        }
    }
}