Forum Discussion

Gwensdolyn's avatar
Gwensdolyn
Copper Contributor
Jun 10, 2026

UEFI KEK Certs not updated on Windows 10

I have a Huawei D14 matebook from 2021 and updated the microsoft certificates, when I check this I get the following output, I see that the KEK cert is not updated is that stored in the bios ? Am I safe this way? Please help.

 

3 Replies

  • MaxThunder's avatar
    MaxThunder
    Iron Contributor
    Jun 14, 2026

    Yes, KEK is stored in UEFI firmware/NVRAM, not just Windows; you’re probably okay for now if Secure Boot is enabled and Windows Update/BIOS are current, but the KEK should eventually be updated via Microsoft/OEM firmware updates because Microsoft says both DB and KEK need the newer 2023 certs before the older Secure Boot certs expire in 2026. 

  • Ziaoik's avatar
    Ziaoik
    Iron Contributor
    Jun 12, 2026

    Generally, if the KEK is not updated and you haven't encountered issues with Secure Boot or firmware updates, your system is likely still safe.

  • Attila Matyas's avatar
    Attila Matyas
    Brass Contributor
    Jun 10, 2026

     

    https://www.youtube.com/watch?v=7vfIaO70WQ0

     

    https://www.catalog.update.microsoft.com/search.aspx?q=kb

    https://consumer.huawei.com/en/support/pc-manager/

    https://www.youtube.com/watch?v=_Htuf2DroIY

    The original 2011 Microsoft Secure Boot Key Exchange Key (KEK) and Signature Database (DB) certificates are expiring in June and October 2026. To ensure your system continues receiving early-boot security updates, these must be replaced with the updated 2023 certificate versions.

     

    Most supported Windows 10 and Windows 11 devices will receive this update automatically via Windows Update. 

     

    Run PowerShell as an administrator and execute the following commands: [1, 2]

     

    Check for the 2023 KEK:

    [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI KEK).bytes) -match 'Microsoft Corporation KEK 2K CA 2023'

    Check for the 2023 DB Signatures:

    [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db). bytes) -match 'Microsoft UEFI CA 2023

     

    https://github.com/powershell/powershell/releases

     

    Huawei does not provide direct offline driver packages; instead, you must use the official PC Manager to keep your Windows 11 drivers updated.Visit the Official Site: Go to the PC Manager | HUAWEI Support Global page.Download the App: Navigate to the specific support page for your exact laptop model, find the "Driver Download" section, select PC Manager, and download the installer.Run the Installer: Once downloaded, open the package and follow the on-screen instructions.

    https://www.driveridentifier.com/