A laptop that had been unused for several weeks failed to start Windows, displaying the message: “Invalid signature detected. Check secure boot policy in setup.” The usual suggestion to disable Secure Boot was not an option because the setting was grayed out in the UEFI/BIOS.
The issue appeared to be related to Secure Boot certificates. Microsoft had announced that new certificates would be needed, but their rollout to PCs has been uneven. The laptop owner suspected its existing certificates were outdated and looked for a BIOS update that included the replacements.
The manufacturer’s support page offered an update, although its release notes were not visible until the download was complete. The notes said it would add “DB keys Windows UEFI CA 2023 & Microsoft UEFI CA 2023.” After checking the support page matched the laptop model, the owner copied the update to a USB drive and installed it through the UEFI/BIOS.
The laptop then booted into Windows normally. The account notes that a suitable certificate update may not be available for every affected computer, and that the release-note wording may not make its connection to Secure Boot obvious.
Sources: PCWorld.