Question about the MS-7D43 motherboard and the Secure Boot certificate expiration issue

[rand857159302e0]

Does anyone know which/if any BIOS update for the MS-7D43 motherboard contains the new Secure Boot certificates?

I'd rather not update the BIOS unless I have to when everything is working fine/stable but if an updated BIOS contains the new 2023 Secure Boot certificate then fine.

Thanks in advance!

 

[dvair]

The certificates are issued through Windows Updates. If you are up to date, you should be OK.

You can check your system using the tools from here:

GitHub - cjee21/Check-UEFISecureBootVariables: PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables as well as scripts for other Secure Boot related items.

PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables as well as scripts for other Secure Boot related items. - cjee21/Check-UEFISecureBootVariables

github.com

Scroll down to the "Before Using" paragraph, download the main.zip file. The contents will contain command files to check your system and update it if needed. Just read through the page and compare the screenshots to your results. I used this on my own computer and had no issues.

 

[rand857159302e0]

I read about that but in the case of the motherboard I mentioned in my first post (and a few others I've still got lying around from MSI), the Event Viewer shows Event ID 1801 since Windows 11 was last reinstalled (Dec 2025), once per system boot/reboot from what I could see. "Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware." I've a few posts on this forum regarding that same issue.

On their website MSI mentions (https://us.msi.com/faq/faq-11305):

Method 1: BIOS Update

For models equipped with Intel 12th Gen or AMD Ryzen 5000H and newer processors, MSI provides BIOS updates that include the new Secure Boot certificates.

I have a 12600k CPU on that system, hence my original question. I guess I'll have to read on how to force it to update if it can be done.

 

[dvair]

I think the errors are mainly from both certificates being in the database. If you download the file in my link and run the Check Windows Sate it will show you what is on your system.