Cigent FDE Installation Error – “Microsoft Certs are missing”

Issue

When installing a current version of Cigent FDE, the installer may display the following message and terminate the installation:

Microsoft Certs are missing.

Cause

Microsoft is transitioning Windows Secure Boot from certificates originally issued in 2011 to new 2023 Secure Boot certificates. The Microsoft UEFI CA 2011 certificate previously used to trust Microsoft-signed third-party UEFI applications expired in 2026 and has been replaced by the Microsoft UEFI CA 2023 certificate.

Current versions of Cigent FDE contain boot components signed by Microsoft using the Microsoft UEFI CA 2023 certificate. For systems with Secure Boot enabled, this certificate must be present in the system's UEFI Secure Boot signature database (DB) for the Cigent FDE boot components to be trusted.

As a precaution, the Cigent FDE installer checks for the required Microsoft UEFI CA 2023 certificate before modifying the system. If the certificate is not detected, installation is stopped. This prevents a situation where FDE installs successfully but the system is subsequently unable to boot because the firmware does not trust the FDE boot components.

Resolution

Before installing Cigent FDE, verify that the system's UEFI Secure Boot configuration includes the Microsoft UEFI CA 2023 certificate.

Step 1: Verify the BIOS Secure Boot settings

Some computer manufacturers, including Dell, provide a BIOS setting that controls whether the Microsoft UEFI CA certificates are included in the Secure Boot signature database.

On supported Dell systems, this setting is typically labeled Enable Microsoft UEFI CA and can be found under the BIOS Secure Boot or Boot Configuration settings.

1. Enter the system BIOS/UEFI setup.
2. Locate the Secure Boot configuration settings.
3. If an option to enable the Microsoft UEFI CA is available, ensure that it is Enabled.
4. Save any changes and restart the system.

The exact location and name of this setting may vary by manufacturer and BIOS version.

Step 2: Update the Microsoft UEFI CA certificate

If the Microsoft UEFI CA option is already enabled, but the Cigent FDE installer continues to report the missing certificate, the system may not yet have the required Microsoft UEFI CA 2023 certificate installed in its Secure Boot database.

Microsoft is distributing updated Secure Boot certificates to supported Windows systems through Windows updates and related update mechanisms. Some systems, particularly organization-managed devices, may require additional administrative action or firmware updates.

Microsoft provides instructions and additional information here:

Microsoft – Windows Secure Boot certificate expiration and CA updates

Follow the applicable Microsoft guidance for your Windows version and device type. Also ensure that all applicable Windows updates and system firmware/BIOS updates provided by the computer manufacturer have been installed.

Step 3: Retry the Cigent FDE installation

After confirming that the Microsoft UEFI CA setting is enabled (where applicable) and that the Microsoft UEFI CA 2023 certificate has been added to the Secure Boot database, restart Windows and run the Cigent FDE installer again.

Important

Do not attempt to bypass the Cigent FDE certificate check. The check is intended to prevent a potential boot failure on systems whose Secure Boot configuration does not yet trust components signed with the Microsoft UEFI CA 2023 certificate.

If the error persists after completing these steps, contact Cigent Support for further assistance.