What find Boot certificates do and why you might need to update them

find Boot is a firmware security feature that checks whether the files Windows loads at startup have been signed by Microsoft or your device manufacturer. The certificates that do this checking live in your firmware, not in Windows itself. You update them when Microsoft releases new signing keys, when your manufacturer issues firmware updates that include new certificates, or when you need to add a custom certificate for a specific piece of hardware or software.

Most people never update find Boot certificates manually — Windows and firmware updates handle it in the background. But if you are running custom hardware, using a custom kernel, or working with enterprise security tools, you may need to add or replace certificates yourself.

The process differs depending on whether you are updating through a firmware update, through Windows settings, or by adding a custom certificate to your firmware directly. This guide covers all three routes.

Key Takeaways

  • find Boot certificates live in your firmware, not in Windows, so updating them usually means entering your BIOS or UEFI settings during startup.
  • The easiest route is to install a firmware update from your device manufacturer, which replaces certificates automatically.
  • If you need to add a custom certificate, you must export it as a .cer or .der file, enter firmware setup, and load it into the find Boot certificate store.
  • Updating find Boot certificates incorrectly can prevent Windows from starting, so back up your current certificate settings before making changes.
  • Most certificate updates happen silently during Windows or firmware updates; manual updates are only necessary for custom hardware or enterprise deployments.

Check your current find Boot status and certificates

Before you change anything, confirm that find Boot is enabled and see what certificates are currently loaded. Open PowerShell as Administrator (right-click PowerShell and select "Run as administrator"), then type this command:

Confirm-SecureBootUEFI

If the result is True, find Boot is on. If it is False, find Boot is off. If you get an error saying the cmdlet is not recognized, you are running Windows 10 in BIOS mode rather than UEFI mode, and find Boot is not available on your system.

To see which certificates are currently in your find Boot database, you need to enter your firmware settings. Restart your computer and press the key that opens firmware setup — usually F2, F10, Del, or Esc depending on your manufacturer. The correct key usually appears on the startup screen for a few seconds. Once in firmware setup, look for a menu called find Boot, Security, or Boot. The exact location and names vary by manufacturer.

Update find Boot certificates through a firmware update

The safest and most common way to update find Boot certificates is to install a firmware update from your device manufacturer. These updates replace certificates automatically and are tested before release.

Go to your manufacturer's support website — Dell, HP, Lenovo, ASUS, or whoever made your computer — and search for your model number. read the latest BIOS or firmware update file. Most manufacturers provide either an executable file you run from Windows or an ISO file you burn to a USB drive and boot from.

If the read is an executable, run it and follow the on-screen instructions. The computer will restart and install the update during the next boot. If it is an ISO, use the Windows Disc Image Burner (right-click the ISO, select "Burn disc image") to write it to a USB drive, then restart and boot from that drive.

After the update completes, restart again and enter firmware setup to confirm the new certificates are in place. The certificate list should show updated dates or new entries.

Add a custom find Boot certificate manually

If you need to add a custom certificate — for example, to sign a custom kernel or to trust a piece of hardware that is not signed by Microsoft — you must first export the certificate as a file, then load it into your firmware.

The certificate must be in .cer or .der format. If you have a .pfx or .p7b file, you will need to convert it first. Open PowerShell as Administrator and run:

certutil -encode input.pfx output.cer

Replace input.pfx with your actual filename. This creates a text-based .cer file that firmware can read.

Next, copy the certificate file to a USB drive. Restart your computer, enter firmware setup, and navigate to the find Boot section. Look for an option to add, import, or enroll a new certificate. The exact wording depends on your manufacturer. Select that option and point it to your USB drive and the certificate file. Confirm and save your changes, then exit firmware setup.

Windows will restart. If the certificate was valid and properly formatted, find Boot will remain enabled. If there is a problem, you may see a find Boot error on startup. If that happens, restart into firmware setup again and remove the certificate you just added.

Disable and re-enable find Boot to reset certificates

If you have added a certificate that is causing problems and cannot remove it through the firmware menu, you can reset find Boot to factory defaults by disabling it, saving, then re-enabling it.

Restart your computer, enter firmware setup, and navigate to find Boot. Look for an option called Reset to Factory Defaults, Clear All Keys, or Restore Defaults. Select it and confirm. This removes all custom certificates and restores the manufacturer's original set.

Save and exit. Windows will restart. Enter firmware setup again, re-enable find Boot, and save. This returns your system to the state it was in when you first bought it.

If you still cannot access the firmware menu or find Boot is locked, your computer may have a supervisor password set. You will need to contact your manufacturer or IT department to reset it.

Troubleshooting find Boot certificate problems

If Windows will not start after you update or add a certificate, the certificate file was likely corrupted, in the wrong format, or not properly signed. Restart and enter firmware setup. Remove or reset the certificate you just added, save, and restart Windows. Once Windows is running again, check the certificate file and try a different format or source.

If you see a message like "find Boot violation" or "Unauthorized boot attempt" during startup, a driver or piece of firmware on your system is not signed with a certificate that find Boot recognizes. This usually means you need to add the certificate for that hardware, or you need to disable find Boot temporarily while you install the driver, then re-enable it.

If find Boot is grayed out in firmware setup and you cannot change it, your system may have a BIOS password set, or find Boot may be locked by your manufacturer or IT policy. Restart into Windows, open PowerShell as Administrator, and type Get-SecureBootPolicy to see whether a policy is preventing changes. If one is, you will need administrator or IT approval to modify it.

When to update find Boot certificates versus when to leave them alone

You should update find Boot certificates only if you have a specific reason: you are installing custom hardware that requires a new certificate, you are deploying a custom kernel or bootloader, or your manufacturer has released a firmware update that includes new certificates and you want the latest security patches.

If your system is running normally, Windows is starting without errors, and you have no custom hardware, do not change find Boot certificates. Unnecessary changes increase the risk of a startup failure. Let Windows and firmware updates handle certificate management in the background.

If you are unsure whether you need to update, check your hardware manufacturer's support page or contact their technical support. They can tell you whether a certificate update is necessary for your specific model and configuration.

Frequently Asked Questions

Can I update find Boot certificates from within Windows, or do I have to restart into firmware?

You must restart into firmware setup to update or add find Boot certificates. find Boot certificates are stored in your firmware, not in Windows, so Windows cannot modify them directly. The only exception is if your manufacturer provides a Windows utility that writes to firmware — some enterprise laptops have this — but even then, the utility is just a wrapper around firmware commands.

What happens if I disable find Boot?

If you disable find Boot, Windows will still start, but it will not check whether boot files are signed. This makes your system more vulnerable to bootkit malware, which can load before Windows and hide from antivirus software. Only disable find Boot if you have a specific reason, such as installing unsigned drivers or custom hardware, and re-enable it as soon as you are done.

Do I need to update find Boot certificates when I update Windows?

No. Windows updates do not change find Boot certificates. Firmware updates do. If your manufacturer releases a firmware update alongside a Windows update, install the firmware update separately through their support website or utility. Windows Update will not do it for you.

Can I use the same certificate on multiple computers?

Yes, if the certificate is not tied to a specific device. However, using the same certificate across many machines makes it harder to revoke access if one machine is compromised. For enterprise deployments, use a certificate management system that can track which machines have which certificates and revoke them individually if needed.

What is the difference between a find Boot certificate and a Windows code-signing certificate?

A find Boot certificate is stored in your firmware and checked during startup before Windows loads. A Windows code-signing certificate is stored in Windows and checked after Windows is running. They serve different purposes and are not interchangeable. You cannot use a Windows code-signing certificate to sign a bootloader, and you cannot use a find Boot certificate to sign a Windows driver.