[Guide] Resolving Windows Secure Boot Certificate Update Warning on Framework Laptop 13

Community Support
, ,
1

Overview

After installing the latest Framework BIOS, Windows Security may display the following warning:

image
image737×266 7.08 KB

Secure Boot is on, but your device does not support the automated Secure Boot certificate update due to hardware or firmware limitations.

Although the message indicates a hardware or firmware limitation, it may simply mean that Windows has not yet completed the Secure Boot certificate migration.

This article describes the steps that successfully resolved this issue on:

  • Framework Laptop 13 (Intel 12th Gen) running BIOS 03.20
  • Framework Laptop 13 (Intel 13th Gen) running BIOS 03.17

Prerequisites

Before beginning:

  • Update the system to the latest Framework BIOS.
  • Install all current Windows Updates.
  • Verify that Secure Boot is enabled.
  • Verify the system is booting in UEFI mode.

Step 1 – Suspend BitLocker

Suspend BitLocker protection before making any Secure Boot changes.

From an elevated Command Prompt:

manage-bde -protectors -disable C:

Or from:

Control Panel → BitLocker Drive Encryption → Suspend Protection

Step 2 – Restore Factory Secure Boot Keys

  1. Reboot the system and enter BIOS Setup.
  2. Navigate to the Secure Boot configuration page.
  3. Select Restore Factory Keys (or the equivalent option to restore the factory Secure Boot databases).
  4. Save the BIOS configuration and reboot into Windows.

Note: Do not manually import Secure Boot certificates or modify Secure Boot databases unless specifically instructed by Framework Support.

Step 3 – Monitor Secure Boot Migration Progress

Windows performs the Secure Boot certificate migration over multiple boot cycles. This process may take several reboots before completing.

Event Viewer Monitoring

Open:

Event Viewer
  └── Windows Logs
       └── System

Select Filter Current Log…

Configure the filter as follows:

Event Sources

TPM-WMI

Event IDs

1801,1802,1803,1808

image
image805×819 87.2 KB

Understanding the Event IDs

Event ID 1801

Meaning

Windows has detected that the Secure Boot certificate update is pending and additional processing is required.

Typical Action

Continue with additional reboot cycles.

Event ID 1802

Meaning

Windows has determined the platform cannot currently perform the automated Secure Boot update.

Typical Action

Verify the BIOS version and Secure Boot configuration.

If this event persists after updating the BIOS and restoring the factory Secure Boot keys, contact Framework Support.

Event ID 1803

Meaning

Windows has begun the Secure Boot migration but has not yet completed the Key Exchange Key (KEK) update.

Example event text:

“A PK-signed Key Exchange Key (KEK) cannot be found for this device.”

Although this event is logged as an error, it may represent an intermediate stage of the migration rather than a permanent failure.

Typical Action

Allow Windows to continue processing and perform additional reboot cycles.

Event ID 1808

Meaning

The Secure Boot certificate update has completed successfully.

This indicates Windows has finished updating the Secure Boot databases.

Step 4 – Complete the Reboot Cycle

After restoring the factory Secure Boot keys:

  1. Allow Windows to remain running for approximately 15–20 minutes.
  2. Reboot the system.
  3. Allow Windows to run again.
  4. Repeat the reboot process several times over approximately one hour to 90 minutes.

During testing (by reviewing Event Viewer filter), Windows progressed through the Secure Boot migration over multiple boot cycles before completing successfully.

Verify Successful Completion

Successful completion is indicated by:

  • The Windows Security warning no longer appears.
  • Event Viewer records Event ID 1808.
  • Secure Boot remains enabled.
  • The system boots normally without BitLocker recovery.

Once the migration has completed successfully, resume BitLocker protection if it was suspended.

Example:

manage-bde -protectors -enable C:

Tested Configurations

System BIOS Version Result
Framework Laptop 13 (Intel 12th Gen) 03.20 Successful
Framework Laptop 13 (Intel 13th Gen) 03.17 Successful

Summary

The Windows Security warning does not necessarily indicate unsupported hardware or missing Secure Boot certificates.

In the tested Framework Laptop 13 systems, the issue was resolved by:

  1. Updating to the latest BIOS.
  2. Suspending BitLocker.
  3. Restoring the factory Secure Boot keys.
  4. Allowing Windows to complete the Secure Boot certificate migration over several reboot cycles.
  5. Monitoring TPM-WMI events (1801, 1802, 1803, and 1808) to track migration progress.

No manual certificate imports or Secure Boot database modifications were required.

2

I tried this and on restart it asked for a recovery key. I used an offline account when setting it up so the key isn’t attached to a Microsoft account.

3

The recovery key mentioned has nothing to do with a Microsoft account. It has to do with drive encryption. The Manage Bitlocker application allows for export of the key to not only a Microsoft account but also to a file and to a printer. It can be assumed that drive encryption was on if you got that inquiry.

4

Can you at least add a note in the steps that a BitLocker recovery key could be needed since it detects that the “Secure Boot policy unexpectedly has changed” ?

5

Absolutely, let me put a section for preventative care.

6

For those who don’t know how to get the Bitlocker recover key, use:

manage-bde -protectors -get C:

it looks like:

123456-223456-323456-423456-523456-623456-723456-823456
7

The command listed above should be executed by selecting “Windows Powershell”, right-click on your mouse and select “Run as administrator”. Then execute the command indicated. You should save all the output. The ID value is to be matched and the Password value is to be entered, if recovery is needed.

If you desire to perform the same task from a GUI perform the following:

In the Windows 11 search bar type ‘Manage Bitlocker’ (without the quotes).

Select Backup your recovery key:

image
image1686×940 48.7 KB

Choose a safe location to output the information (not on the disk for the computer).

image
image930×727 18.6 KB

This will allow you to recover in the case that you forget to disable the drive encryption (BitLocker).