Secure boot expiring certificates on Azure Trusted Launch VMs

I did find that 'Microsoft UEFI CA 2023' and 'Microsoft Option ROM UEFI CA 2023' are for thirt-party bootloaders.

So as I read it we do not have to take action for these ones and can ignore these events, right?

It is a bit frustrating because we also have a bunch of on-premises Windows servers and we checked the Azure VMs after colleagues mentioned to examine this on Azure.
Then we are going to monitor the 2 servers that lack the KEK 2023 and Windows EUFI CA 2023 certificates.

Hello Bas,

Thank you for reaching out regarding the Secure Boot certificate status on your Azure Trusted Launch VMs.

Based on your observations, the behavior you’re seeing (certificate checks returning “false” and Event ID 1801) is generally associated with the Secure Boot certificate update lifecycle. Microsoft has been rolling out updates to Secure Boot components (such as KEK, DB, and UEFI CA certificates), and these updates are delivered through standard Windows Update mechanisms.

For Azure Gen2 VMs with Trusted Launch enabled, these updates are handled automatically as part of regular OS patching. In most cases, no manual action is required, and I recommend ensuring that all latest Windows updates are applied across your VMs.

Regarding Event ID 1801, this is typically informational and may appear during certificate evaluation or transition phases. If Secure Boot remains enabled and there are no functional issues with the VM, this event can generally be considered benign.

At this time, manual changes—such as modifying Secure Boot-related registry keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot—are not required unless specifically directed by Microsoft for a known issue.

References:

https://support.microsoft.com/en-us/topic/kb5012170-security-update-for-secure-boot-dbx-72ff5eed-25b4-47c7-be28-c42bd211bb15

https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch

Hope this helps! Please let me know if you have any queries in comments.

AFAIK, the presence of EventID 1801 on Azure Gen2 VMs indicates that the guest operating system lacks the permissions to directly modify the UEFI variables that are managed by the Azure platform infrastructure. Since Azure controls the virtual firmware and the Trusted Launch environment, it is expected for the OS to report a failure when trying to write to these protected keys. You can generally ignore this event as long as the VM continues to boot correctly and the Azure portal confirms that Trusted Launch and Secure Boot are enabled and healthy.

The discrepancy in certificate status across your servers indicates that the underlying Azure host nodes are at different stages of the rolling update for the 2023 UEFI certificates. The fact that some servers report false for the newer certificates simply means the virtual firmware for those specific instances has not yet been updated with the 2023 KEK or CA. Microsoft is managing this transition globally for Azure infrastructure, so you do not need to take manual action to push these certificates into the UEFI.

You should not manually set the registry keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot to force an update. In an Azure environment, forcing these updates through the registry can cause conflicts with the platform-managed secure boot process or lead to persistent error logging without actually updating the underlying firmware. Your primary responsibility is to ensure that regular Windows Updates are applied, specifically those related to the Secure Boot DBX (Forbidden Signature List), which allows the OS to recognize and trust the new certificate chain once Azure updates the virtual hardware.

If you want to verify the current status of Secure Boot on a specific VM via PowerShell, you can use the Confirm-SecureBootUEFI cmdlet to check if it is active regardless of the specific certificate versions.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin