The platform must expose an interface that adheres to the profile of UEFI v2.3.1 Section 27.

For more information, search for the system requirements in PDF download of the Windows Hardware Compatibility Program Specifications and Policies. Variables must be set to SecureBoot=1 and SetupMode=0 with a signature database (EFI_IMAGE_SECURITY_DATABASE) necessary to boot the machine securely pre-provisioned, and including a PK that is set in a valid KEK database. In order to support Secure boot, you must provide the following. When you add UEFI drivers, you'll also need to make sure these are signed and included in the Secure Boot database.įor information on how the secure boot process works included Trusted Boot and Measured Boot, see Secure the Windows 10 boot process. The OEM can use instructions from the firmware manufacturer to create Secure boot keys and to store them in the PC firmware. If the signatures are valid, the PC boots, and the firmware gives control to the operating system.

When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM).

Asus secure boot windows 11