- Microsoft is blocking Secure Boot certificate updates on some computers because of firmware compatibility issues.
- Affected devices continue to boot normally and receive regular Windows updates, but future boot-level security protections won’t install.
- Some PCs only need a UEFI firmware update from the manufacturer, while older unsupported hardware may never receive the new certificates.
- Microsoft advises keeping Secure Boot enabled and checking the OEM for firmware updates instead of trying to bypass the block.
Microsoft has confirmed that it is blocking new Secure Boot certificate updates on some Windows 11 devices after identifying firmware compatibility problems that could prevent the update from installing correctly. The company says the pause is intentional and designed to avoid putting affected computers into an unsupported security state while it works with hardware partners.
Microsoft confirms some PCs won’t receive the update yet
On the official support page, the company explained that while the updated Secure Boot certificates are rolling out automatically through Windows Update on most compatible devices, a subset of computers has been excluded because of known firmware limitations or unresolved compatibility issues.
The small number of affected devices will now notice a message inside the Windows Security app stating:
Devices in this group are affected by a known issue. To reduce risk, Secure Boot certificate updates are temporarily paused while Microsoft and partners work toward a supported resolution.
According to Microsoft, some systems simply need a newer UEFI firmware update from the computer manufacturer before Windows 11 (or 10) can safely install the new certificates.
Others may never receive the update because the hardware is no longer supported by the OEM or its firmware cannot support the newer Secure Boot trust configuration.
Why Microsoft is blocking the update
The decision may sound unusual, but it reflects how Secure Boot works. Unlike a typical Windows update, Secure Boot relies on trusted certificates stored in a computer’s firmware. The operating system cannot replace those certificates unless the firmware is prepared to accept them.
If the company detects that a firmware version could cause installation failures or leave the trust chain in an inconsistent state, Windows now blocks the update instead of forcing it.
That also explains why Microsoft is directing users to their computer manufacturer’s support pages rather than offering a universal fix through Windows Update.
Your PC will continue to work
The good news is that an affected device does not become unusable after missing the Secure Boot certificate update.
Microsoft says Windows 11 (and 10) will continue to boot normally, monthly security updates will continue to install, and everyday tasks such as browsing, gaming, and running applications will remain unchanged.
The limitation is more gradual. Devices without the updated certificates won’t receive future boot-level security protections, including new revocations for compromised bootloaders. As new threats emerge, those systems will slowly fall behind fully updated devices in protecting the startup process at its earliest stage.
Microsoft also warns against disabling Secure Boot. Even without the latest certificates, keeping Secure Boot enabled provides stronger protection than turning the feature off entirely.
What you should do
If Windows Security reports that Secure Boot certificate updates are paused or blocked, there is little users can do from Windows itself.
Has your PC received the new Secure Boot certificate update?
Voting closes: July 17, 2026 1:00 pm
Instead, the company recommends checking for UEFI firmware updates from your computer manufacturer. Once a compatible firmware update becomes available, the Secure Boot certificate update will be delivered through the normal Windows Update process.
For most Windows 11 users, nothing needs to be done. The rollout continues automatically on supported hardware, while Microsoft and OEMs work through the remaining firmware compatibility issues before expanding availability.
Mauro Huculak is a Windows How-To Expert and founder of Pureinfotech in 2010. With over 23 years as a technology writer and IT Specialist, Mauro specializes in Windows, software, and cross-platform systems such as Linux, Android, and macOS.
Certifications: Microsoft Certified Solutions Associate (MCSA), Cisco Certified Network Professional (CCNP), VMware Certified Professional (VCP), and CompTIA A+ and Network+.
Mauro is a recognized Microsoft MVP and has also been a long-time contributor to Windows Central.
You can follow him on YouTube, Threads, BlueSky, X (Twitter), LinkedIn and About.me. Email him at [email protected].
