Fix Invalid Signature Detected Secure Boot Error in Windows

The error Invalid Signature Detected. Check Secure Boot Policy in Setup can appear when Windows Boot Manager is signed with Windows UEFI CA 2023, while that certificate is missing from the UEFI allowed-signature database. A firmware reset, update, replacement, or cleared NVRAM can create this mismatch.

Understand the failure

With Secure Boot enabled, UEFI validates bootmgfw.efi before starting Windows. If its signing certificate is not present in the db database, firmware blocks the boot process. Wording varies by manufacturer.

Disabling Secure Boot may allow Windows to start, but it bypasses boot-file signature validation. Use it only as a temporary recovery measure.

Verify the certificate state

Temporarily disable Secure Boot in UEFI settings and boot Windows.
Open an elevated PowerShell session and check whether the certificate is present:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI -Name db).Bytes) -match "Windows UEFI CA 2023"

The expected result for this scenario is usually False. You can also inspect the signer of the EFI boot file. The EFI volume letter may differ:

Get-PfxCertificate -FilePath "E:\EFI\microsoft\boot\bootmgfw.efi" | Format-List Subject, Issuer

If the boot file is associated with Windows UEFI CA 2023, the missing UEFI certificate is a likely cause.

Create recovery media

Use a USB drive that can be erased. Confirm the disk number carefully before running DiskPart commands.

diskpart
list disk
sel disk 2
list part
sel part 1
format fs=fat32 quick
assign letter=G
exit

The disk number and drive letter are examples. Replace them with values from your device. Create the UEFI boot path and copy the recovery executable:

mkdir G:\EFI\BOOT -Force
copy C:\Windows\Boot\EFI\SecureBootRecovery.efi G:\EFI\BOOT
cd G:\EFI\BOOT
ren .\SecureBootRecovery.efi bootx64.efi

The executable can also be copied from another supported Windows 11 device that has received recent cumulative updates.

Restore the UEFI certificate

Restart the computer and enable Secure Boot again.
Choose the USB drive as the boot device.
UEFI starts bootx64.efi from the standard removable-media path.
The tool checks the firmware database and imports Windows UEFI CA 2023 if it is missing.

When the process finishes, remove the USB drive and set Windows Boot Manager as the first boot option.

Verify successful recovery

Windows should now start with Secure Boot enabled. In elevated PowerShell, run the database check again:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI -Name db).Bytes) -match "Windows UEFI CA 2023"

A result of True confirms that the certificate is visible in firmware. Also check the Secure Boot status under Windows Security and Device Security.

Alternatives and operational cautions

A manufacturer-provided UEFI update may provide a long-term correction, but firmware updates should follow the hardware vendor’s procedure and must not be interrupted. Leaving Secure Boot disabled reduces boot-chain protection. In an enterprise, test the recovery process on representative hardware first, then record the boot result, Secure Boot state, and certificate check.

Practical takeaway: confirm the mismatch, build a FAT32 recovery USB, run the recovery executable with Secure Boot enabled, and verify both the certificate and successful Windows boot afterward.

Sources

WOSHUB