{"id":17571,"date":"2026-07-02T15:52:14","date_gmt":"2026-07-02T13:52:14","guid":{"rendered":"https:\/\/www.forsis.de\/kennisbank\/microsoft-uefi-ca-2023-secure-boot-certificate-update\/"},"modified":"2026-07-29T16:10:36","modified_gmt":"2026-07-29T14:10:36","slug":"microsoft-uefi-ca-2023-secure-boot-certificate-update","status":"publish","type":"kennisbank","link":"https:\/\/www.forsis.de\/en\/knowledge-base\/microsoft-uefi-ca-2023-secure-boot-certificate-update\/","title":{"rendered":"Microsoft UEFI CA 2023 \u2013 Secure Boot Certificate Update"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Affected FORSIS Product Series<\/h2>\n

All FORSIS Industrial Panel PCs from the EXPERT, PROFI, MOBILE, and MASTER series.<\/p>\n

Background Information<\/h3>\n
\n
\"\"<\/figure>\n
\n

In June 2026, Microsoft began replacing the original Secure Boot certificates from 2011. The old certificates are expiring or will expire soon. For you, this means that FORSIS Industrial PCs that are not updated to the new 2023 certificates will no longer receive security-relevant updates for the boot process from that point onwards. <\/p>\n<\/div>\n<\/div>\n

Depending on the age and BIOS status of the industrial PC in use, an action may be required. We would like to support you with this. <\/p>\n

Technical Terms on UEFI CA 2023<\/h2>\n

Below is a brief overview of the various technical terms to facilitate a better understanding.<\/p>\n

<\/h2>\n
\n\n\n\n\n\n\n\n\n\n\n\n\n
Technical Term<\/th>\nA brief explanation<\/th>\n<\/tr>\n<\/thead>\n
Secure Boot<\/td>\nSecurity feature in UEFI BIOS. Ensures that only trusted, digitally signed software is loaded during startup. Prevents bootkits and rootkits<\/td>\n<\/tr>\n
UEFI<\/td>\nUnified Extensible Firmware Interface \u2013 modern successor to the classic BIOS. Firmware interface between hardware and operating system.<\/td>\n<\/tr>\n
UEFI CA 2023<\/td>\nThe new Microsoft certificate (Certificate Authority 2023) that will be used to sign all Windows boot components from 2026 onwards<\/td>\n<\/tr>\n
Platform Key (PK)<\/td>\nThe system’s master key, embedded in the motherboard firmware by the manufacturer, e.g., MITAC, IGAIPC, etc., for our FORSIS devices. This can only be changed via a BIOS update.<\/td>\n<\/tr>\n
Key Exchange Key (KEK)<\/td>\nAuthorizes changes to the signature databases DB and DBX. Must contain the new ‘Microsoft Corporation KEK 2K CA 2023’<\/td>\n<\/tr>\n
Signature Database (DB)<\/td>\nDatabase of allowed signatures. Must contain ‘Windows UEFI CA 2023’ for the Boot Manager to be trusted.<\/td>\n<\/tr>\n
forbidden sig. DB (DBX)<\/td>\nRevocation list: Compromised or withdrawn boot signatures are entered here. Continuously updated by Microsoft.<\/td>\n<\/tr>\n
chain of trust<\/td>\nHierarchical chain of trust: PK \u2192 KEK \u2192 DB\/DBX \u2192 Bootloader \u2192 Operating System. Each level verifies the next.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

The Chain of Trust<\/h2>\n
\n
\"\"<\/figure>\n
\n

Secure Boot operates with a hierarchical trust structure.<\/p>\n

Each level must be current for the update to take full effect.<\/p>\n

As a system integrator, we generally receive the PK and KEK keys from the motherboard providers. This does not necessarily apply to all boards previously used. However, we are happy to provide you with information on this. <\/p>\n

Only a BIOS update from the manufacturer can correctly integrate the new Microsoft KEK 2K CA 2023 key into the firmware.<\/p>\n<\/div>\n<\/div>\n

What happens if you do not perform an update<\/h2>\n

Devices without updated certificates will continue to boot normally and receive regular Windows updates.
However, these devices<\/p>\n