Beelink CS-June
Here is a screenshot for you.
https://ibb.co/xqzN2NwX
Both my SER8’s have the same Bios and the same message about older boot trust configuration that should be updated.
Here is some info I found about the issue.
It has something to do with the Secure Boot Certificate 2023 update.
I ran the following commands to scan your firmware for the 2023 certificates in powershell and it came up ’true" which means I do have the 2023 Secure Boot Certificate.
Method 2: Check using PowerShellPress the Windows Key, type PowerShell, right-click it, and select Run as Administrator.Run the following commands to scan your firmware for the 2023 certificates🙁[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).bytes) -match ‘Microsoft Corporation KEK 2K CA 2023’)([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)If the output returns True, the 2023 certificates are successfully installed.
Also under event viewer I have error ID 1801
Screenshot
https://ibb.co/RG3bLp7P
No sure if this is my case but a user posted the following about it.
**It’s not the BIOS, I already “solved” it. Got very detailed information from Microsoft support . Just to answer your question, my BIOS is from June 2024 running very stable, so i don’t have a reason to update and risk it. (Plus i have seen a lot of people in forums that updated their Bios and still have the same mismatch event 1801.)
Here’s the Microsoft official employee respond to anyone that is confused and is in same situation :
“The low - level checks (Powershell verification of DB/DB Default/KeK and Windows2023capable =2 ) confirm that the 2023 certificates are already present and actively used at boot,but the security app is still showing ” Older boot trust" because Microsoft’s cloud side validation of your specific device model, firmware version and update stage has not yet been finalized. When the classification data is incomplete, the app intentionally reports a conservative warning rarher than “up to date” even though the actual Secure Boot trust chain is correct.
This is why you also see “Event ID 1801” ‘Certificates available,but not yet applied’ it reflects a transitional reporting state, not the real enforcement state in firmware.
Once Microsoft completes backened validation and updates the device’s classification , the security app status will automatically align with what your checks are already showing, without any action required from you. The message you are seeing is about status synchronization and reporting, not about missing protection. As long as your checks continue to confirm DB/KEK and WindowsUefica2023Capable = 2 you are already in good and safe state - The UI will catch up automatically.
Since the 2023 Secure Boot keys are already present and being used, a BIOS update is not required to resolve the message you are seeing in Windows Security.
BIOS updates are generally only needed if the OEM explicitly states they are required to add missing secure boot certificates or fix a firmware bug.
The reason Windows security app shows “Old boot trust” is a known and expected mismatch not an actual regression in your secure boot configuration.
The Windows security app message and the Even ID 1801 “Certificates available, but not yet applied” reflect Microsoft’s phased validation and telemetry - based classification process, not a missing certificate or misconfiguration."**
https://forums.tomshardware.com/threads/regarding-secure-boot-certificate-2023-update.3894934/
There is a lot of info about this on the internet so perhaps you can look into this?
Long story short it sounds like I just need to wait for Microsoft to release updates and the message will then go away???
Thanks
