B760 PRO RS Secure Boot Key missing

ok. thanks well...

Hello.
How are you getting on with the certificates?
Still nothing?

Same for me. They?™re there but they don?™t work.

Thank you so much!
so theres nothing to worry about?

I wouldn't worry, ASRock has already released updates for a number of older boards.
Even my old x370 Taichi has gotten an update for this. I suspect all that is
needed in the UEFI on newer boards may already be present. It seems only older
boards got updates so far which leads me to believe the updated security key
will come via windows update. I don't see security certificates mentioned in any
of the latest BIOS versions for newer boards (current and last gen). All the older
boards that received an update for this state:

Update Secure Boot Key (2023 KEK/DB/PK)

This is why I suspect newer boards already have what is needed for the new keys.
All the older boards that got an update hadn't had a BIOS update for quite some
time, a year or more in most cases. This means the update needed for secure boot
couldn't have been implemented in an earlier update. The last official update before
this one for the x370 Taichi was in 2023 for example. There are some newer beta
updates but they only added CPU support/RAM compatibility.

I found this article while looking into your issue:
https://learn.microsoft.com/en-us/answers/questions/5652654/secure-boot-certificates-have-been-updated-but-are

It might be of some use to you.

With this kind of thing you often find that details are kept under wraps for
security reasons. I would imagine Microsoft will want as much of this process
automated/hidden as possible.

I wouldn't worry about it, your system is still current and well within the
required specs for Windows 11. ASRock (all manufacturers really) won't leave
you high and dry.

Hope this helps.

That is strange. Have you tried the following:

1. Open PowerShell as Administrator
2. Enter the following command to check your certificate status:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

3. If the result is an error (variable undefined) then enter this:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

4. Then enter:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

5. Restart the system and then enter PowerShell as administrator again.
6. Reenter the command from 2 and you should see "True" confirming the update has been applied.

Let me know if it works.

Edited by Xaltar - 20 Apr 2026 at 2:00pm