The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The “Secure Boot Violation – Invalid Signature Detected” screen means your PC’s UEFI firmware rejected a pre-Windows boot file because its signing certificate is not present or no longer trusted in the Secure Boot databases. It does not, by itself, mean that Windows or your personal files have been erased. First preserve your BitLocker recovery key, then temporarily disable Secure Boot only if necessary to start Windows, install current Windows and manufacturer firmware updates, restore the correct Secure Boot keys or certificate, repair boot files only when diagnostics identify boot damage, and turn Secure Boot back on.
What the “Invalid Signature Detected” message means
Secure Boot is a UEFI trust check that runs before Windows. Firmware verifies the digital signature of the Windows Boot Manager and other pre-OS images against several databases:
As an Amazon Associate I earn from qualifying purchases.
- PK (Platform Key) establishes ownership of the platform.
- KEK (Key Exchange Keys) authorizes updates to the allowed and revoked signature databases.
- DB (allowed-signature database) contains certificates and hashes that may run.
- DBX (revoked-signature database) blocks signatures that are no longer trusted.
The violation appears when the boot image cannot be validated against the firmware’s current trust data. A reset to “factory” or “default” Secure Boot keys can empty or replace those databases. On systems whose Windows boot manager uses the Windows UEFI CA 2023 certificate, removing that certificate prevents the firmware from trusting Windows at the next startup. A firmware update or failed firmware operation can also overwrite or corrupt the allowed-signature database.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match“This scenario isn’t caused by the Secure Boot update itself but by a subsequent firmware action that removes the updated trust anchors.” — Microsoft Support
#1 Best Overall
NewHail TPM2.0 Module LPC 14Pin Module with Infineon SLB9665 for ASUS Motherboard Compatible with TPM-M R2.0
- Compatible with TPM-M R2.0
- Chipset: Infineon SLB9665
- PIN DEFINE:14Pin
- Interface:LPC
- Please check the Pinout of mainboard at the official website and make sure it compatible with the pinout of TPM module before purchasing, thank you.
That distinction matters: replacing boot files or reinstalling Windows is not the first response to a trust-database problem. The correct remedy depends on whether Windows can start with Secure Boot temporarily disabled, whether the keys were reset, whether boot files are damaged, and whether the computer manufacturer has issued a firmware fix.
Before changing Secure Boot: protect access and data
Find the BitLocker recovery key
Secure Boot changes alter the measurements that BitLocker uses to protect the system volume. Microsoft warns that mitigations and firmware changes can trigger a BitLocker recovery prompt. Locate or back up the recovery key before entering firmware setup. If the computer belongs to an employer or school, the key may be held by its IT administrator. Do not begin a key reset when you have no way to retrieve the recovery key; a firmware change can leave you at a recovery screen even after the signature problem is fixed.
Record the current configuration
Photograph or write down the existing settings for Secure Boot, boot mode (UEFI versus Legacy/CSM), storage-controller mode, and boot order. Do not change unrelated options while troubleshooting. A wrong storage or boot-mode setting can create a second startup failure that obscures the original signature problem.
Recommended Free Tools
Have recovery media available
If Windows will not start, prepare Windows installation or recovery media on another computer. Microsoft’s certificate-recovery method specifically requires a FAT32 USB flash drive. Keep a separate Windows installation USB available for Startup Repair and the Bootrec commands described later.
Choose the repair path that matches the failure
Use this table before changing settings. It prevents using boot-file commands for a firmware trust problem or resetting keys when the real issue is a damaged BCD.
Rank #2
- Nuvoton NPCT650
- TCG PC Client Platform TPM Profile (PTP) Specification; Family 2.0 (Trusted Platform Module Library; Family 2.0)
- TCG PC Client Specific TPM Interface Specification (TIS), Version 1.3 (TPM Main Specification; Family 1.2 Revision 116)
- Low Standby Power Consumption
| What you observe | Most likely issue | Appropriate action | When to escalate |
|---|---|---|---|
| Windows starts after Secure Boot is disabled | Firmware is rejecting a signature; Windows itself may be intact | Install Windows and OEM firmware updates, then restore the required keys or certificate and re-enable Secure Boot | If the error returns after a current firmware update, contact the manufacturer |
| The error began immediately after choosing “Reset,” “Clear,” or “Restore defaults” for Secure Boot keys | The Windows UEFI CA 2023 certificate or other trusted keys were removed | Use the SecureBootRecovery.efi FAT32 USB procedure, or use the firmware’s default-key installation option when it restores the correct OEM set | If the utility cannot restore the certificate, obtain model-specific OEM support |
| Secure Boot is already configured correctly, but Startup Repair reports BCD or boot-code errors | Boot files or the Boot Configuration Data store may be damaged | Run Startup Repair first; use BOOTREC only for the corresponding diagnostic | If repair cannot find a Windows installation, stop before rebuilding blindly and obtain technical help |
| The failure follows a BIOS/UEFI update and persists even with keys restored | Firmware defect or missing platform-authorized keys | Install a newer manufacturer firmware release if available | Manufacturer support is required when no corrected firmware exists |
| BitLocker requests a recovery key | Firmware or Secure Boot measurements changed | Enter the previously retrieved recovery key, then continue the repair | If the key is unavailable, use the organization or account that manages BitLocker; do not erase the drive as a first step |
Step 1: Enter UEFI/BIOS setup safely
The menu is called UEFI firmware setup, BIOS setup, or simply Setup depending on the manufacturer. The startup key is model-specific; common keys include F1, F2, F12, and Esc. Begin tapping the key immediately after pressing the power button. If Windows still starts, use its recovery menu instead:
- Open Settings.
- Choose System, then Recovery.
- Under Advanced startup, select Restart now.
- Choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
Menu labels vary by model. Look under Security, Boot, Authentication, or Trusted Computing for Secure Boot and key-management controls. Do not use a “Clear Secure Boot keys” command as a diagnostic experiment; clearing keys can create the exact trust failure you are trying to remove.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 2: Disable Secure Boot only to regain access
- In UEFI setup, open the Secure Boot control.
- Set it to Disabled. If the firmware requires an administrator password or a confirmation code, follow the on-screen prompt.
- Save changes and exit, commonly with Save & Exit or the F10 key.
- Allow Windows to start, if it can.
This is a temporary access measure, not the finished repair. Microsoft warns that incorrectly applied BIOS changes can prevent startup. If Windows still does not boot with Secure Boot disabled, skip to the recovery-media and boot-repair sections rather than repeatedly toggling the setting.
Step 3: Update Windows and the computer’s firmware
Once Windows starts, install all available Windows updates and restart as requested. Then obtain the newest BIOS/UEFI firmware offered for the exact computer model from its manufacturer. Firmware packages are model-specific; do not flash a package for a similar-looking system or interrupt power during the update.
Firmware defects and missing OEM-signed keys require a manufacturer-provided update or support case. If the manufacturer’s release notes mention Secure Boot, certificate, signature, or key-database fixes, apply that release before restoring keys. If no current update is offered, record the model and firmware version for support. Do not substitute a generic firmware image.
Rank #3
- Compatible with：TPM2.0(MS-4462)
- Chipset: INFINEON 9670 TPM 2.0
- PIN DEFINE:12-1Pin
- Interface:SPI
- Supports：MSI Intel 400 Series and 500 Series Motherboards,MSI AMD B550 and A520 Series Motherboards,Windows 10 TPM 2.0
After updating, shut down fully and re-enter UEFI setup. Check whether the update repopulated the expected Secure Boot keys. Firmware may call the operation Restore Factory Keys, Install Default Keys, Load Default Secure Boot Keys, or something similar. Wording and behavior differ by OEM. Choose an option that installs the manufacturer’s default keys, not one that clears them.
Free tools Windows power users keep installed
One-click scans. No signup required.
Step 4: Restore the Windows UEFI CA 2023 certificate after a key reset
If the error began after Secure Boot keys were reset and Windows remains blocked, Microsoft provides a recovery utility named SecureBootRecovery.efi. It restores the Windows UEFI CA 2023 certificate from removable media. The procedure requires another updated Windows computer and a FAT32-formatted USB drive.
Create the recovery USB
- On another updated Windows PC, open
C:WindowsBootEFI. - Copy
SecureBootRecovery.efito a FAT32 USB drive. - On that drive, create the folders
EFIBOOT. - Place the copied file in that folder and rename it exactly to
bootx64.efi, producing the pathEFIBOOTbootx64.efi. - Eject the drive safely.
Keep the drive FAT32. A USB formatted as NTFS or exFAT may not be recognized as UEFI boot media for this procedure.
Run the utility on the affected PC
- Insert the USB drive into the affected computer.
- Open the one-time boot menu using the model’s startup key, or select the USB device in UEFI boot order.
- Boot the USB in UEFI mode.
- Allow the recovery utility to run and restore the Windows UEFI CA 2023 certificate.
- Power off, remove the USB drive, and enter UEFI setup.
- Confirm that Secure Boot is enabled or enable it again, then save and restart.
If the utility does not run, verify the exact path, filename, FAT32 format, and UEFI boot selection. If the firmware refuses the media or reports that the certificate cannot be installed, the platform may need an OEM firmware update or manufacturer-assisted key enrollment. Do not repeatedly clear or replace databases while testing.
Step 5: Repair boot files only when diagnostics indicate boot damage
A valid Secure Boot signature does not repair a missing or damaged BCD. Conversely, BOOTREC cannot recreate a certificate that firmware no longer trusts. Use these tools only after the trust-database issue has been addressed or when Startup Repair identifies a boot-file problem.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- TPM 2.0 module for Asus motherboard.
- TPM 2.0 module chip 2.0mm pitch, 2x7P, 14 pin security module
- LPC 14 Pin for AsusTPM chip is better compatible with DDR4 memory module of motherboard, built in support memory type higher than DDR3! Supported states may vary by motherboard specification.
- Note: Don't support laptops and motherboards prior to X99; Don't support DDR3 memory.
- Packing list:1x TPM 2.0 Module for ASUS
Run Startup Repair
- Boot from Windows installation or recovery media.
- Select your language and keyboard options, then choose Repair your computer, not Install.
- Open Troubleshoot > Advanced options > Startup Repair.
- Select the Windows installation when prompted and let the process finish.
- Remove the USB and restart to test normal UEFI boot.
Startup Repair is the least invasive option in this branch. If it reports that it cannot repair the PC, note the displayed diagnosis before opening Command Prompt.
Use BOOTREC for the matching BCD or boot-code error
From Troubleshoot > Advanced options > Command Prompt, Microsoft documents these commands:
BOOTREC /FIXMBR
BOOTREC /FIXBOOT
Bootrec /ScanOS
bootrec /rebuildbcdRun only the command appropriate to the reported problem and read each result. /ScanOS searches for Windows installations not currently listed in the BCD; /rebuildbcd rebuilds that list when a valid installation is found. If the recovery environment assigns Windows a drive letter other than C:, identify the correct volume before attempting additional commands. Do not format a partition or delete the BCD merely because a command returns an error; an incorrect volume or a still-disabled trust certificate can produce misleading results.
Step 6: Re-enable Secure Boot and verify the result
- Restart into UEFI setup after Windows and firmware updates are complete.
- Confirm that the manufacturer’s default keys or the restored Windows UEFI CA 2023 certificate are present.
- Set Secure Boot to Enabled.
- Save and restart.
- Confirm that Windows reaches the sign-in screen and that no BitLocker recovery prompt appears on the next restart.
If the machine immediately returns to “Invalid Signature Detected,” disable Secure Boot once more to regain access, record the exact firmware version and error wording, and contact the computer manufacturer. Repeatedly restoring defaults can remove additional trust anchors. A manufacturer may need to supply a corrected BIOS/UEFI image or model-specific instructions.
Common situations and the right response
The screen says to “check Secure Boot Policy in Setup”
That wording points to a firmware policy decision, not necessarily a damaged Windows installation. Enter Setup, inspect Secure Boot status and key databases, and determine whether a reset or firmware update preceded the failure. Use temporary disablement only to boot and complete updates; do not leave the security feature off permanently when the platform can be repaired.
Best Value
- Product Color: Black
- Width: 0.6"
- Depth: 0.5"
- Additional Information: Interface: SPI Features: TPM IC: Nuvoton NPCT750 TPM Version: TPM 2.0 Pin Dimension: 14-1pin System Requirements: Windows® 10, UEFI OS
- Country of Origin: Vietnam
The problem appeared after a BIOS update
A BIOS update can change or overwrite the allowed-signature database. Install the newest corrected firmware offered for the exact model and restore the OEM key set if the update removed it. If the current release still loses keys, the manufacturer must diagnose the firmware defect; Windows repair commands cannot correct firmware storage.
Windows starts, but Secure Boot cannot be enabled
Leave Secure Boot disabled while you verify that Windows is fully updated, the firmware is current, and the correct keys are installed. Check that the system is using UEFI boot rather than Legacy/CSM mode, but change boot mode only after recording the current setting and confirming that the Windows installation supports the target mode. If enabling Secure Boot fails immediately, return to the previous setting and obtain OEM guidance.
The computer shows a black screen or no boot device after changing settings
Return to UEFI setup and restore the recorded boot mode, storage-controller mode, and Windows Boot Manager entry. If Windows Boot Manager is absent, use Startup Repair from installation media. Avoid changing several firmware options at once; otherwise you cannot identify which setting caused the new symptom.
BitLocker recovery appears after the repair
Enter the recovery key you located before making the change. A recovery prompt after Secure Boot or firmware changes is expected protection behavior, not evidence that the drive is corrupted. Once Windows starts, verify that protection is active and that you can retrieve the key again before making further firmware changes.
Why certificate timing matters in 2026
Microsoft states that Secure Boot certificates originally issued in 2011 begin expiring in June 2026. That timeline makes current firmware and certificate support especially important: a computer can be fully patched in Windows yet still lack the firmware trust anchors needed to validate a newer Windows boot manager. If a manufacturer has not supplied updated keys or firmware for your model, document the model and firmware version and request a supported update rather than clearing the databases.
What not to do
- Do not assume the error proves personal files are gone.
- Do not clear Secure Boot keys repeatedly or choose an ambiguous “reset” command without knowing what certificates it installs.
- Do not flash firmware intended for another model or interrupt a firmware update.
- Do not run every BOOTREC command automatically; match commands to the diagnosed boot failure.
- Do not disable BitLocker or erase the Windows volume as a first response.
- Do not leave Secure Boot disabled after access is restored if the platform can be repaired.
When manufacturer support is the correct fix
Escalate to the OEM when the firmware cannot retain keys, the default-key option installs an incomplete set, the recovery USB is rejected, or no corrected BIOS/UEFI release is available. Provide the support team with the exact model, current firmware version, whether the failure followed an update or key reset, the Secure Boot status, and any BitLocker prompt. Those details distinguish a missing certificate from damaged boot files and reduce the risk of an unnecessary Windows reinstall.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
