How Can I Fix a Secure Boot Invalid Signature Error on a BIOSTAR H410MH S2?

First disable Secure Boot so you can boot normally, then check whether BIOSTAR has a newer BIOS for this exact motherboard revision. If an update is available, install it carefully, load the default Secure Boot keys through Key Management, and enable Secure Boot again. The board’s latest firmware may not include newer certificate updates, though, so updating the BIOS might not solve this permanently. Do not reset the keys blindly if Windows has already staged a certificate update.

Since Windows boots as soon as Secure Boot is disabled and you did not add unsigned software, the problem is probably a firmware key or certificate compatibility issue rather than damaged Windows files. Leave Secure Boot off for now, make sure you have a current backup, and avoid manually importing random keys or EFI files. If the motherboard firmware has no update supporting the required certificates, your practical choices may be to keep Secure Boot disabled or eventually use newer hardware.

The claim that the older 2011 certificate is simply expired is not necessarily correct, so the error does not automatically mean the motherboard needs to be replaced. With Secure Boot disabled, run these PowerShell commands as Administrator and check the results:

Get-ItemProperty 'HKLM:SYSTEMCurrentControlSetControlSecureBootServicing' | Select-Object UEFICA2023Status,WindowsUEFICA2023Capable,UEFICA2023Error

Get-WinEvent -FilterHashtable @{LogName='System';ProviderName='Microsoft-Windows-TPM-WMI';Id=1036,1037,1799,1801,1808} -ErrorAction SilentlyContinue | Select-Object TimeCreated,Id,Message

An event 1799 or a status showing that the 2023 certificate was updated is important. If you see that, do not use “Restore Factory Keys,” because resetting them could make the recovery process harder. Instead, use Microsoft’s official Secure Boot recovery procedure and obtain the recovery EFI file from a trusted, fully updated computer rather than downloading a random copy.