My ASUS ROG FX553V running Windows 11 shows "Secure Boot Violation – Invalid Signature Detected" every time I start it. Windows loads normally if I disable Secure Boot in the firmware settings, but I'm unsure whether leaving it disabled is safe or how to restore Secure Boot properly. I haven't installed Linux or Battlefield 6, which are sometimes mentioned as possible causes. What should I check, and how can I fix the invalid signature without risking my files?
3 Answers
This can happen when the firmware’s Secure Boot certificates or keys are outdated, especially after certificate changes or a Windows update. First, run a Microsoft Defender Offline scan to rule out malware. Then install every available Windows security update and check ASUS’s support page for the newest BIOS or firmware for your exact model. After restarting, try enabling Secure Boot again. Since this laptop’s last BIOS release may be from 2019, newer firmware might not be available, but it’s still worth checking.
Disabling Secure Boot is usually why Windows will boot, but it removes an extra protection against boot-level malware and unauthorized startup code. It isn’t an immediate sign that the laptop is compromised, but it’s better treated as a temporary workaround. Keep Defender enabled, run an offline scan, back up your data, and avoid changing BIOS key settings or reinstalling Windows until you understand whether the problem is caused by the firmware, boot files, or expired Microsoft certificates.
Secure Boot verifies that the software loaded during startup has a trusted digital signature. An invalid-signature warning can be caused by outdated Secure Boot keys, a firmware issue, damaged boot files, or malware. Microsoft’s guidance for this error explains how to refresh the trusted certificates and keys. If the normal procedure doesn’t work, a specialized utility such as Mosby may be able to update the keys, but back up important files first and follow the instructions carefully.
How can I tell whether one of the certificates has expired, and is there a safe way to install updated certificates if Windows Update doesn’t offer anything?