Secure Boot locked me out of my own Windows laptop. Here’s what finally fixed it | usagoldmines.com

You turn on your laptop. Or at least, you try. The screen stays black, with just nine words displayed in white: Invalid signature detected. Check secure boot policy in setup.

Congratulations, you have a secure boot problem. But it may not be fixable in the way past internet forum threads and Reddit posts will suggest. Instead, you’ll probably have to roll up your sleeves, break out a USB drive, and run some BIOS updates.

Here’s how I found out the hard way.

A laptop that wouldn’t boot into Windows

Earlier this month, I started up a laptop I hadn’t used in a few weeks. It refused to boot. Instead, it threw up an error message about an invalid signature.

Past internet posters suggested changing the secure boot settings in the UEFI/BIOS. Supposedly, if you turn off the feature, you can get back into Windows. 

Unfortunately for me, the secure boot settings were grayed out in this laptop’s UEFI. I couldn’t touch them. And if I’d been most other people, I might have stalled out there.

Secure Boot is currently a mess

ASUS

Lucky for me, I had wrangled this past summer with Secure Boot. It didn’t feel fortunate at the time—I had to do all that poking around because of Microsoft’s erratic handling of updated certificates. Basically, Microsoft warned in advance that new certificates would be needed, but no one fully took charge. At the last moment, Microsoft stepped in.

(If you’re picturing the Spider-Man meme where several Spider-Men are all pointing at each other, you have the feel of it.)

The rollout, as you might have predicted, has been haphazard. Even now, Microsoft’s not done with pushing out the new certificates to all PCs. I have one PC that originally got the thumbs up, only to have it retracted because the new certificates were causing a conflict. So it’s hanging out in limbo.

Thanks to that deep dive into Secure Boot, I had a strong feeling my sudden issue had to deal with outdated certificates. So perhaps, if I could update the BIOS to a newer version that included those certificates, it would solve my issue.

Not everyone will catch this break

I hopped over to manufacturer’s website for my laptop, pulled up the latest UEFI/BIOS updates, and got to downloading. On the site, no release notes were listed—I had to wait until the zip file completed before I could verify what the update included. Even then, the language wasn’t immediately clear: Add DB keys Windows UEFI CA 2023 & Microsoft UEFI CA 2023.

I knew what they were. But I don’t think most folks would look at that and think, “Of course, this relates to Secure Boot.”

Likewise, not everyone would even have a fix available. When I saw that release note, I counted my blessings—I could’ve had a laptop without any certificate updates ready. 

A little elbow grease, a lot of anxiety

After triple-checking to make sure I had the correct support page for my laptop model, I loaded the file on a USB drive. It would have been terrible if I’d gotten this far, only to botch everything by flashing the wrong file.

(Not familiar with how to update a BIOS? Our guide walks you through the process.)

Then I restarted the machine, entered the UEFI/BIOS, and ran the update. Lo and behold, once the BIOS was flashed, the laptop booted normally into Windows once again. Problem fixed.

But while I can use the machine again, I don’t feel relaxed about it. I wonder what else is going to break next—with potential high-risk security implications. These days, Windows 11 isn’t feeling like an effortless, modern, and secure operating system.