Secure Boot (UEFI)

Secure Boot is the bouncer at your PC's door: no valid signature, no entry. These days some games check whether the bouncer is on shift.

The short answer

Secure Boot is a UEFI firmware feature that checks code before it runs during startup: each program needs a trusted signature and checksum, otherwise the firmware refuses to execute it [3]. Windows 11 requires firmware that is "UEFI, Secure Boot capable" [2], and Linux distributions such as Debian boot with Secure Boot switched on through a small Microsoft-signed loader called shim [3]. Our assessment: leave it on, and switch it off only when you knowingly run unsigned code and accept that some games will then refuse to start.

How it works

1. A chain of signatures. The PC verifies the firmware's signature at the start of the boot process. Secure Boot then checks the signature of the OS bootloader and of all code that runs before the operating system against the Secure Boot policy [1]. On Windows, Trusted Boot continues the chain: the bootloader checks the kernel, and the kernel checks boot drivers and the early-launch antimalware driver [1].
2. Key databases in the firmware. The firmware keeps trusted certificates in databases. The KEK signs updates to the DB and DBX, the DB holds the certificates that may sign boot code, and the DBX lists revoked signatures [4]. Most x86 hardware ships with Microsoft keys preloaded [3].
3. Linux through shim. Since Debian 10, Debian uses shim, which is signed by Microsoft and embeds Debian's own keys, so Debian can sign its kernel and GRUB itself [3]. You can add your own Machine Owner Keys (MOK) with mokutil; changes must be confirmed at the console during the next boot, so malware cannot quietly enroll a key [3].
4. Lockdown and drivers. With Secure Boot on, the Linux kernel runs in lockdown mode and refuses kernel modules that are not signed by a trusted key. Drivers built on your machine with DKMS must be signed with an enrolled MOK [3].
5. Certificates expired. Microsoft's Secure Boot certificates from 2011 expired in 2026: the KEK CA 2011 on 24 June, the UEFI CA 2011 on 27 June and the Windows Production PCA 2011 on 19 October [4]. Devices without the newer 2023 certificates keep booting, but they no longer receive new protections for the early boot process [4]. Since April 2026, the Windows Security app shows the update status under Device security, Secure Boot [5].
6. Games ask for it. EA requires Secure Boot to play Battlefield 6 on PC and uses it, together with features such as the TPM, against kernel-level cheats and rootkits [7]. EA says some of its games require Secure Boot for its Javelin anti-cheat [6].

A practical example

A game reports that Secure Boot is off. Press Windows+R, run msinfo32 and open System Summary: BIOS Mode should read UEFI and Secure Boot State should read On [6]. If BIOS Mode shows Legacy, the Windows disk has to use GPT instead of MBR; EA describes the conversion with mbr2gpt [6]. After that, enable Secure Boot in the UEFI settings, with the OS type set to Windows UEFI mode [6]. On a Debian dual boot with a DKMS driver, you enroll the generated key instead of switching Secure Boot off, then confirm it at the next boot [3]:

sudo mokutil --import /var/lib/dkms/mok.pub

This is a generic walk-through, not a report from our own hardware.

Checklist

• Check BIOS Mode and Secure Boot State in msinfo32 [6].
• Convert an MBR system disk to GPT before you switch the firmware to UEFI [6].
• Read the Secure Boot message under Device security in Windows Security, not just the green check mark [5].
• Ask your PC or board maker for a firmware update if Windows reports that the certificate update is blocked [5].
• Enroll a MOK for DKMS drivers on Linux instead of disabling Secure Boot [3].
• Read your board manual before changing firmware settings; EA warns that wrong settings can stop a PC from starting [6].