How to verify the Windows Secure boot certificates have been updated.

Question

How to verify the Windows Secure boot certificates have been updated.

Ka Ho Cheng 570

We have found the above alert from Microsoft for Month Security Patch KB information.

We have Windows 10, Windows Server 2016, Windows Server 2019 in closed network and patching by WSUS.

Refer to information, I understanding that we need to renew the certificate before Jun 2026.

However, I do not know how to update the new certificate and how to verify the new certificate Would you help?

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer accepted by question author

Jason Nguyen Tran 24,530 Independent Advisor

Hi Ka Ho Cheng,

As I know, Microsoft has released guidance under KB5062710 to address the upcoming certificate expiration in June 2026. Since your environment uses WSUS in a closed network, you’ll need to ensure this KB is manually approved and deployed to all applicable devices (Windows 10, Server 2016, Server 2019).

To verify that the Secure Boot certificates have been updated, you can inspect the UEFI Secure Boot key database (db) using PowerShell or your firmware interface. On supported systems, run Get-SecureBootUEFI and check for updated certificate entries. You may also use Get-SecureBootPolicy if available, or consult your OEM’s firmware tools to confirm that the Microsoft UEFI CA certificate has been refreshed.

If your systems do not show updated certificates, you’ll need to manually import the new Secure Boot keys using Microsoft’s published update packages or OEM tools. I recommends completing this update well before June 2026 to avoid boot failures.

I hope this helps clarify the verification and update process. If this explanation is useful, please hit “Accept Answer” so I know your concern is resolved.

Jason.

Robert Thorne 0 Reputation points

2026-04-24T21:53:01.1+00:00

Jason: I am too ignorant to understand PowerShell operations. I've checked for KB 5062710 in update history. It is not present. "Check for updates" again, says: "You are up to date."
Adam J. Marshall 10,871 Reputation points MVP

2026-04-26T14:40:04.6266667+00:00

@robert - If you're on Windows 11, latest CU (April), open Start > Windows Security > Device Security. Look at Secure Boot - if it's Green, you're using Secure Boot and the message below will tell you if you need to do anything.

1 additional answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Robert Thorne 0 Reputation points

2026-04-24T21:53:01.1+00:00

Jason: I am too ignorant to understand PowerShell operations. I've checked for KB 5062710 in update history. It is not present. "Check for updates" again, says: "You are up to date."
Adam J. Marshall 10,871 Reputation points MVP

2026-04-26T14:40:04.6266667+00:00

@robert - If you're on Windows 11, latest CU (April), open Start > Windows Security > Device Security. Look at Secure Boot - if it's Green, you're using Secure Boot and the message below will tell you if you need to do anything.

Answer 1

Jason Nguyen Tran 24,530 Independent Advisor

Hi Ka Ho Cheng,

Just checking in, were you able to get the issue resolved? If so, it would be great if you could mark the answer as Accepted so others in the community can benefit from your experience. Thank you!

Ka Ho Cheng 570 Reputation points

2026-01-22T06:16:00.6333333+00:00

Checked the KB5062710 is the Cumulative Update patch. Is it mean that if the PC / notebook which installed the least Cumulative Update patch (after Jun 2025), the secure boot certificate(s) is also update. right?
Jason Nguyen Tran 24,530 Reputation points Independent Advisor

2026-01-22T06:58:23.27+00:00

Hi Ka Ho Cheng,

Yes, you're correct. The KB5062710 is a cumulative update that includes the refreshed Microsoft UEFI CA certificates required for Secure Boot validation. Any device that has successfully installed this update or a later cumulative update released after June 2025 should receive the updated certificates, assuming Secure Boot is enabled and the firmware supports certificate injection.

However, please note that certificate injection depends on both firmware compatibility and proper update deployment. In WSUS-managed or closed environments, it's essential to verify that the update was approved and applied correctly. To confirm the certificate update, you can run Get-SecureBootUEFI in PowerShell and inspect the key database (db) for the new Microsoft UEFI CA entries.

If the updated certificates are not present, manual import using Microsoft’s published packages or OEM tools may be required. I recommend completing this verification well before June 2026 to avoid any boot disruptions.

Jason.
Ka Ho Cheng 570 Reputation points

2026-01-23T06:17:17.7833333+00:00

The next question is ....

The below result is difficult to read. Is it updated or not?

(I have try to another PC that is same result, even it's Windows Update though Internet)
Adam J. Marshall 10,871 Reputation points MVP

2026-01-23T13:52:38.4566667+00:00
Use:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’

If the answer is True, then it has updated. If the answer is False, it hasn't updated.

As of now, my home system getting updates from MS directly shows False
Ka Ho Cheng 570 Reputation points

2026-02-03T02:42:16.8133333+00:00

Unfortunately, the result is FALSE even the least Windows cumulative update had been installed. I have try to use another notebook which installed Windows update patch though internet is still same result.

Since customer has over 15,000 PCs and notebooks, over 500 servers, we need the correct and simple method to ensure the issue can be resolved before Jun 2026. Thanks
Adam J. Marshall 10,871 Reputation points MVP

2026-02-03T17:36:59.73+00:00

I agree. From what I can tell, if you are using Windows Update direct from Microsoft, you will end up getting the update. If you are using WSUS in the mix, to this point, there is no update for the SecureBoot certificate. I just added 8 new systems to the network and before adding to the domain (built from OEM media), I updated via Windows Update. Those systems are the only ones that have the updated SecureBoot certificate. All my existing systems don't (via WSUS). I have a report that will show me if that value mentioned above is true or false, so when I learn how to do it, I'll be posting about it.
Ka Ho Cheng 570 Reputation points

2026-02-04T01:53:38.5766667+00:00

Thank you very much. Hope to hear from you soon.
Websurfer1111 0 Reputation points

2026-03-27T23:07:36.34+00:00

Alright. Good to know that it's there. But I'm not sure, if this also means that it's active. :(
Adam J. Marshall 10,871 Reputation points MVP

2026-04-26T12:35:20.59+00:00

I just realized I never responded back to this comment. My blog is here:

https://www.ajtek.ca/guides/how-to-update-secure-boot-certificates-with-wsus/