As pretty much all vendors are releasing new BIOS updates to fully support the new UEFI CA 2023 certificates, you've probably noticed that many of them include new Secure Boot trust settings. Here is a quick cheat sheet on what they are. The screenshot below is an example from HP, but most vendors have very similar settings.
Real-world note: While the settings show up in the BIOS setup, these aren't BIOS settings in the usual sense (like Boot Order or VT-d); they're entries in the Secure Boot signature database (db) exposed through the BIOS UI.
First, the Important Context: 2011 and 2023 Coexist
The 2023 CAs are not replacing the 2011 ones immediately: Both are enrolled simultaneously through the 2026 expiration window. Devices today ship with both sets of CAs in the Secure Boot signature database, so they can boot existing signed media and accept newer signed media. It's not until you revoke the 2011 certificates that old boot media will stop working.
The new UI you see in BIOS only exposes the new 2023 entries because the 2011 CAs are managed elsewhere. Typically, under "Restore Default Secure Boot Keys" rather than as per-CA checkboxes. Don't read the new boxes as a replacement for the 2011 trust; read them as an addition. Leaving them checked is the right default for most.
Settings Explained
Below is a list of each setting and when to use it.
Windows UEFI CA 2023.
This is the new CA used to sign Windows boot components, including bootmgfw.efi.
The predecessor was Microsoft Windows Production PCA 2011.
Without this CA enrolled and trusted, Windows installations signed using the 2023 certificate chain will not boot. If you're running Windows on the machine, this setting should be enabled.
Microsoft UEFI CA 2023
This is the new CA used to trust third-party UEFI components, including Linux shim loaders, third-party bootloaders, recovery tools, and other EFI applications that are not part of Windows itself.
The predecessor was Microsoft Corporation UEFI CA 2011.
Without this CA enrolled and trusted, Microsoft-signed third-party EFI binaries will fail to load.
Real-world example: If you're using a third-party PXE solution such as iPXE with signed binaries, enable this setting (along with the Enable MS UEFI CA Key master toggle).
Microsoft Option ROM UEFI CA 2023
This is a new trust anchor introduced as part of the 2023 Secure Boot certificate updates.
Option ROMs are firmware components located on hardware devices such as network adapters, storage controllers, RAID cards, and graphics adapters. These components may execute during system startup before the operating system loads.
In the 2011 trust model, Option ROMs were generally covered by the broader Microsoft UEFI CA trust chain. In the 2023 model, Microsoft introduced a dedicated trust anchor specifically for Option ROMs.
Without this CA enrolled and trusted, signed Option ROMs on newly installed hardware may fail to initialize when Secure Boot enforcement is enabled.
Enable MS UEFI CA Key
On HP, this is the master enable for trusting Microsoft's third-party UEFI CA chain. Disabling it does not break Windows itself — Windows boots through the separate Windows UEFI CA. What it does break is everything else Microsoft signs under the third-party program: Linux shim loaders, third-party bootloaders, signed recovery tools, and signed network boot binaries like iPXE.
In fact, Microsoft's Secured-Core PC specification explicitly disables this CA as a hardening measure, since it was the trust path exploited by BlackLotus and similar UEFI bootkits. Other vendors expose equivalent controls under different names; check your specific BIOS UI.
Final note
Enabling these settings does not install the certificates by itself. The corresponding UEFI CA 2023 certificates must already be present in the firmware's Secure Boot variables (typically db and KEK). These toggles simply control whether the firmware trusts and uses those certificates during Secure Boot validation.