How to Fix "Invalid Signature Detected. Check Secure Boot"

You turn on your PC expecting Windows, but instead get a firmware message such as:

“Invalid Signature Detected. Check Secure Boot Policy in Setup.”

Despite the wording, this has nothing to do with signing PDFs or documents.

It is a Secure Boot error.

Secure Boot is part of UEFI firmware. During startup, the firmware verifies trusted boot-time software before handing control to the operating system. This includes components such as EFI applications, bootloaders, firmware drivers, and the operating-system boot chain. If a required component cannot be validated against the system's trusted Secure Boot configuration, the firmware may block it. (Microsoft Learn)

The safest fix depends on what changed before the error appeared.

This guide starts with the least disruptive checks, then covers UEFI mode, Secure Boot keys, temporary disabling, and manufacturer-specific guidance.

Note: This is a firmware and operating-system problem. LoreSign signs documents and contracts; it does not modify Secure Boot, BIOS, UEFI, drivers, or bootloaders.

At a Glance

---

What Does "Invalid Signature Detected" Actually Mean?

Secure Boot helps make sure a PC starts using trusted boot software.

When the PC starts, UEFI firmware validates signatures on boot-time components against keys and signature databases stored by the firmware. If validation fails, the firmware may refuse to launch that component. (Microsoft Learn)

What Secure Boot checks

Secure Boot can validate components such as:

• UEFI applications;
• operating-system boot managers;
• EFI bootloaders;
• firmware drivers and Option ROMs;
• parts of the trusted boot chain.

It should not be described as checking every ordinary Windows driver before Windows starts.

Windows has separate code-integrity and driver-signing policies for kernel drivers once the operating system is involved. (Microsoft Support)

Note: “Invalid signature” does not automatically mean malware. It means the firmware could not validate a boot component under the current Secure Boot configuration.

---

Restore Secure Boot Keys vs Disable Secure Boot

These actions are not equivalent.

Microsoft explicitly recommends re-enabling Secure Boot after a temporary troubleshooting disable. (Microsoft Support)

Tip: If you use custom Secure Boot keys, Linux modules, specialized bootloaders, encryption, or enterprise configuration, record the existing setup before resetting anything.

---

Common Reasons This Error Appears

The safest fix usually depends on what changed immediately before the problem.

BIOS or firmware changes

A firmware update or reset can change Secure Boot configuration, key state, boot mode, or related firmware settings.

Do not assume every BIOS update automatically deletes the Secure Boot keys. Behavior varies by manufacturer and model.

Switching from Legacy/CSM to Secure Boot

Secure Boot requires UEFI.

If Windows was installed using Legacy BIOS mode, simply turning on Secure Boot may not work.

Depending on the system, the disk may also need to use GPT rather than MBR before switching fully to UEFI. Riot's current Secure Boot guidance specifically tells users to verify UEFI mode and GPT configuration before enabling Secure Boot. (Riot Games Support)

Gaming requirements

Some games and anti-cheat platforms require security features such as TPM and Secure Boot.

For example, Riot currently lists TPM 2.0 and UEFI Secure Boot as requirements on Windows 11 for VALORANT. (Riot Games Support)

That means users sometimes discover an old Legacy/UEFI mismatch only when trying to enable these settings.

Linux or dual-boot installations

Do not assume Linux means “unsigned bootloader.”

For example, Ubuntu supports Secure Boot using a Microsoft-signed shim, which then validates Canonical-signed GRUB and other components. (Ubuntu Wiki)

Problems are more likely with:

• custom bootloaders;
• unsigned kernels;
• third-party kernel modules;
• changed Secure Boot keys;
• or distributions/configurations that do not use a trusted Secure Boot chain.

---

How to Fix "Invalid Signature Detected": Step-by-Step

Use the least destructive checks first.

1. Note the exact error message and what changed before it appeared.
2. Check whether the system is configured for UEFI rather than Legacy/CSM.
3. Check Secure Boot status.
4. Follow your PC or motherboard manufacturer's Secure Boot instructions.
5. If appropriate for your system, restore the manufacturer's default Secure Boot keys.
6. Save the BIOS settings and test booting again.
7. Temporarily disable Secure Boot only if needed for troubleshooting.
8. Fix the underlying boot configuration.
9. Re-enable Secure Boot once the system boots correctly.

Important: BIOS interfaces differ significantly by manufacturer and even by model. Do not treat a menu path from another PC as universal.

---

Before You Change Anything

Firmware changes can stop a system from booting if the wrong settings are changed.

Before entering BIOS:

• note the current Secure Boot status;
• note whether BIOS Mode is UEFI or Legacy;
• check whether BitLocker or Device Encryption is active;
• save important work;
• and consult the manufacturer's instructions for your exact model.

Check the current mode in Windows

If Windows still starts:

1. Press Windows + R.
2. Enter msinfo32.
3. Look for BIOS Mode.
4. Look for Secure Boot State.

For Secure Boot, the machine needs to use UEFI rather than Legacy BIOS mode. (Microsoft Support)

---

Step 1: Enter UEFI/BIOS Setup

You can often enter firmware settings directly from Windows.

Windows 11

Go to:

Settings → System → Recovery → Advanced startup → Restart now

Then:

Troubleshoot → Advanced options → UEFI Firmware Settings → Restart

Microsoft documents this route for accessing Secure Boot settings. (Microsoft Support)

You can also enter firmware during startup using a manufacturer-specific key such as:

• F1;
• F2;
• F10;
• Delete;
• or Esc.

The exact key varies by model.

---

Step 2: Check UEFI vs Legacy Mode

Secure Boot works with UEFI firmware.

If the system is configured for Legacy/CSM boot, Secure Boot cannot operate normally. (Microsoft Support)

Do not switch blindly

Changing a machine from Legacy to UEFI without checking how Windows and the disk were configured can leave it unable to boot.

Before converting:

• verify the existing Windows installation mode;
• check whether the system disk is MBR or GPT;
• follow Microsoft or manufacturer migration instructions.

Note: Riot's current guide specifically warns that an MBR disk may need conversion to GPT before UEFI and Secure Boot can be used. (Riot Games Support)

---

Step 3: Check or Restore Secure Boot Keys

Secure Boot uses firmware-managed keys and signature databases to determine which boot software is trusted. (Microsoft Learn)

Some manufacturers provide options such as:

• Restore Factory Keys
• Install Default Secure Boot Keys
• Key Management
• Restore Factory Defaults

The exact name differs.

What restoring keys does

Restoring factory keys typically reinstalls the manufacturer's default Secure Boot trust configuration.

On Lenovo systems, for example, current support documentation explicitly uses Restore Factory Keys to return a system from Setup Mode to User Mode and enable Secure Boot. (Lenovo Support)

What it does not guarantee

Restoring keys will not magically make every bootloader trusted.

It can also remove custom keys.

If you use custom Secure Boot configuration, dual boot, specialized Linux modules, or enterprise key management, understand the consequences first.

---

Step 4: Temporarily Disable Secure Boot Only When Necessary

Microsoft acknowledges that Secure Boot may sometimes need to be disabled temporarily for troubleshooting, but recommends turning it back on afterward. (Microsoft Support)

The option is usually located under a Security, Boot, or similar firmware menu.

Because manufacturers structure their firmware differently, use your device's official documentation instead of assuming one menu path works everywhere.

Why leaving it disabled matters

Secure Boot is designed to prevent untrusted boot software from running during startup. Turning it off removes that validation layer. (Microsoft Support)

Avoid claims such as “it's safe on a home PC.” The security benefit does not disappear simply because the computer stays at home.

---

Brand-Specific Secure Boot Guidance

Menus vary even within a single manufacturer, so treat the following as orientation rather than universal instructions.

---

Lenovo

Lenovo documentation for supported ThinkPad systems shows a Restore Factory Keys option that can return Secure Boot from Setup Mode to User Mode. (Lenovo Support)

Other Lenovo models may use different firmware interfaces.

Do not promise that restoring keys will fix every Lenovo “invalid signature” error.

---

HP

HP's current instructions differ between consumer notebooks, commercial notebooks/workstations, and desktops.

For example, HP documents Secure Boot under System Configuration → Boot Options on some consumer notebooks, while some commercial systems use Security → Secure Boot Configuration. (HP Support)

HP also notes that newer systems may not expose Legacy Support at all.

So wording such as “HP always stores Secure Boot under Security” should be avoided.

---

Gigabyte

On at least some current Gigabyte firmware, the Secure Boot setting is only configurable when CSM Support is Disabled. (GIGABYTE)

That makes “check CSM” useful advice, but the exact menu still depends on the motherboard and firmware version.

---

Razer Blade

This section needs the biggest correction from the original draft.

Razer's current Secure Boot Violation troubleshooting does not simply tell users to restore factory keys and retry.

Its August 2026 support procedure instructs users to:

1. prepare a USB drive;
2. temporarily disable Secure Boot;
3. boot Windows;
4. copy securebootrecovery.efi to the USB drive;
5. re-enable Secure Boot;
6. boot the recovery USB;
7. follow the on-screen recovery process.

Razer also documents the BIOS path for enabling Secure Boot under Security on supported Blade systems.

Note: If this error is occurring on a Razer Blade, follow Razer's model-specific recovery instructions rather than applying generic key-reset advice.

---

What About Driver Signature Enforcement?

This should be treated as a different issue, not another fix for Secure Boot.

Windows uses driver-signing and kernel code-integrity rules to decide whether kernel drivers can load. (Microsoft Support)

That happens at a different layer from UEFI Secure Boot.

So:

Secure Boot error before Windows loads → troubleshoot firmware/boot trust.

Unsigned-driver error inside Windows → troubleshoot Windows driver signing.

Do not disable driver signature enforcement in Windows as a supposed fix for a UEFI Secure Boot error.

---

What About MOK on Linux?

Machine Owner Keys are relevant in Linux Secure Boot environments, but the original draft oversimplified their role.

Ubuntu's Secure Boot chain uses:

Microsoft-signed shim → Canonical-signed GRUB → signed Ubuntu components

MokManager can also manage locally trusted keys, and Ubuntu uses MOKs particularly for third-party kernel modules. (Ubuntu Wiki)

So a better rule is:

If the error started after Linux, a kernel-module installation, or a custom bootloader change, check the Secure Boot documentation for that exact distribution before resetting firmware keys.

---

Common Mistakes When Fixing "Invalid Signature Detected"

Mistake 1: Disabling Secure Boot immediately

It may allow some configurations to boot, but it can hide the real problem.

Check boot mode and manufacturer guidance first.

Mistake 2: Switching Legacy to UEFI without checking the disk

UEFI conversion may require an MBR-to-GPT conversion.

Changing only the firmware option can leave Windows unbootable. (Riot Games Support)

Mistake 3: Resetting keys on a custom Secure Boot setup

Restoring factory keys can remove custom trust configuration.

This matters for:

• custom bootloaders;
• Linux installations;
• locally enrolled keys;
• enterprise-managed PCs.

Mistake 4: Treating Windows driver signing as the same problem

It isn't.

Firmware Secure Boot and Windows driver-signature enforcement are separate security layers.

Final Thoughts

“Invalid Signature Detected” is a Secure Boot validation problem, but there is no single universal BIOS fix.

Start by identifying what changed. Then check whether the system is using UEFI, verify Secure Boot status, and follow the instructions for your exact PC or motherboard.

Restoring default Secure Boot keys can be appropriate on some systems. Temporarily disabling Secure Boot can also help with troubleshooting. Neither should be treated as a universal first-click fix.

Once the underlying boot issue is corrected, re-enable Secure Boot where your configuration supports it. Microsoft recommends restoring the protection after temporary troubleshooting. (Microsoft Support)

And despite the word “signature,” this error is unrelated to signing contracts or PDFs.

Frequently Asked Questions

What does "Invalid Signature Detected" mean?

It generally means UEFI Secure Boot could not validate a boot-time component under the system's current trust configuration.

That can involve an untrusted bootloader, changed or missing keys, incompatible boot media, or another Secure Boot configuration problem.

Is it safe to disable Secure Boot?

It can be useful as a temporary troubleshooting step.

However, Secure Boot provides protection against untrusted boot-time software, so Microsoft recommends re-enabling it once troubleshooting is complete. (Microsoft Support)

Does Secure Boot check every Windows driver?

No.

Secure Boot validates the UEFI boot chain. Windows also has separate driver-signing and code-integrity protections for drivers loaded by the operating system. (Microsoft Learn)

Does Windows 11 require Secure Boot?

Microsoft's Windows 11 system requirements require UEFI firmware with Secure Boot capability. New Windows 11 devices are generally expected to support the feature. (Microsoft Support)

Can Legacy BIOS use Secure Boot?

No. Secure Boot is part of UEFI.

A Legacy/CSM configuration must be migrated appropriately before Secure Boot can be used. (Microsoft Support)

Does Linux work with Secure Boot?

Yes, many Linux distributions do.

Ubuntu, for example, uses a Microsoft-signed shim and Canonical-signed GRUB so supported Ubuntu installations can boot with Secure Boot enabled. (Ubuntu Wiki)

Does this error mean the PC has malware?

Not necessarily.

A Secure Boot error can occur after legitimate firmware, operating-system, key, or bootloader changes.

About LoreSign

LoreSign

LoreSign helps people and businesses create, send, sign, and track documents electronically.

Secure Boot signatures and document signatures serve very different purposes: Secure Boot establishes trust in software during startup, while LoreSign handles electronic document-signing workflows.

]