Short answer: the Microsoft Secure Boot certificates issued in 2011 have now reached their expiry dates (June 24, June 27 and October 19, 2026, according to Microsoft Support), but a PC that has not received the 2023 replacements still starts and runs normally. What it loses is the ability to receive new boot-level security protections. For most people the fix is to keep Windows fully updated and check the status in the Windows Security app; some PCs also need a firmware update from the manufacturer.
This guide is based on Microsoft Support and Microsoft Learn pages, read on 2026-10-25. Where something comes from outside those pages, it is labelled. Rollout details change, so treat the Microsoft pages linked by name as the final word.
Key takeaways
- Microsoft says devices without the 2023 certificates keep booting and keep installing standard Windows updates.
- What stops is new protection for the early boot process: Boot Manager updates, Secure Boot database and revocation list updates, and fixes for newly found boot-level flaws.
- Most Windows PCs are meant to receive the new certificates automatically through Windows Update. Some need an OEM firmware update first.
- Back up your BitLocker recovery key before you do anything, because some devices may show a recovery prompt during the change.
- Do not disable Secure Boot and do not run random scripts from forums. Microsoft explicitly warns against turning Secure Boot off as a workaround.
What is actually expiring, and when
Secure Boot is the UEFI feature that checks that the code starting your PC is signed by a trusted authority before it runs. The trust anchors live in firmware variables called KEK, DB and DBX. Microsoft's support article "Windows Secure Boot certificate expiration and CA updates" lists the following.
| Expiring certificate (2011) | Expires | Replacement (2023) | What it does |
|---|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 | Signs updates to the DB and DBX |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023 | Signs third-party boot loaders and option ROMs |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 | Signs the Windows boot loader |
Because today is October 25, 2026, all three dates are in the past. That is less dramatic than it sounds, as the next section explains.
What happens if your PC does not get the new certificates
Microsoft's wording is calm and specific. A device without the 2023 certificates:
- keeps starting and running normally;
- keeps receiving standard Windows updates;
- cannot receive new Secure Boot and Boot Manager protections, including updates to the Secure Boot databases and revocation lists;
- cannot get early-boot fixes such as BitLocker bypass mitigations and new Secure Boot revocations;
- may see problems with scenarios that depend on Secure Boot trust, such as BitLocker hardening, boot-level code integrity, and third-party boot loaders and option ROMs.
Microsoft describes the effect as protection that becomes progressively weaker as new threats appear. It does not describe a sudden failure, and nothing in these pages says an unupdated PC is unsafe today. It is a gradual gap, not a cliff.
Who is affected
Microsoft says that since Secure Boot was introduced, Windows devices have carried the same Microsoft certificates in KEK and DB, so the issue covers most devices that use Secure Boot. The article's "Applies to" list includes Windows 10 (including LTSC and IoT editions), Windows 11 versions 21H2 through 24H2 and Windows 11 SE, and Windows Server 2012 ESU through Windows Server 2025.
Two groups deserve a closer look:
- PCs with Secure Boot turned off. Secure Boot has to be enabled for the firmware certificate update to apply, so do not turn it off as a workaround. Check Microsoft's current Secure Boot guidance for details.
- Older models whose manufacturer no longer ships firmware. Microsoft says the OEM may no longer support the PC or provide the firmware needed to update its Secure Boot trust configuration.
On Windows 10: support ended October 14, 2025, and Microsoft's pages that I read do not spell out how the certificate rollout applies to a consumer Windows 10 PC. I could not find a Microsoft page that spells out exactly how this applies to a consumer Windows 10 PC enrolled in ESU, so confirm that on Microsoft's current Secure Boot pages before you rely on it.
How to check your status
The simple way: Windows Security
Microsoft's page "Secure Boot certificate update status in the Windows Security app" says to open Windows Security, then Device security, then Secure Boot. The badge meanings, as described there:
| Badge | Meaning (Microsoft wording, shortened) | What to do |
|---|---|---|
| Green check | Microsoft says green means sufficiently protected, with no action needed. Open the Secure Boot page to read the exact status message shown there. | Nothing |
| Yellow | Older boot trust configuration, or a hardware or firmware limitation, or extra validation needed | Install the latest Windows updates and restart; contact the manufacturer if the message says the device cannot take the automated update |
| Red "Requires action" | The device can no longer receive required updates for the Windows boot experience | Follow the aka.ms/getsecureboot link shown on the page |
| Updates paused | Affected by a known issue; Microsoft paused the update | Nothing; it resumes automatically once fixed |
Microsoft advises against dismissing a warning if your device has not yet received the new certificates. On company-managed PCs these badges are off by default and an administrator controls them.
The technical way: only what Microsoft documents
You can confirm that Secure Boot itself is on with the standard PowerShell cmdlet, run in an elevated window:
Confirm-SecureBootUEFIIt returns True when Secure Boot is enabled and False when it is off (the cmdlet is part of Windows' Secure Boot module; I did not find it in the certificate articles I read, so this is general Windows behaviour rather than a certificate check).
For the certificate update itself, Microsoft's Secure Boot event documentation and Microsoft Q&A answers point to these signs that a device is not updated: the Secure Boot certificate status shows "not updated", the System event log contains Event ID 1801 or Event ID 1795, or the registry value UEFICA2023Status is not set to Updated. Microsoft's page does not give the registry path in the text I read, and community answers (not official) mention 1808 as a success event. For home PCs, the Windows Security app is the safer and supported check. Registry and event work is mainly for administrators following Microsoft's playbook at aka.ms/securebootplaybook.
How the new certificates get delivered
Microsoft says most Windows devices receive the updated certificates automatically, and that it manages the process for a significant share of devices. Organisations that manage their own updates can use Microsoft Intune, registry keys, a Configuration Service Provider, or Group Policy, per the Learn article and the Secure Boot playbook. Microsoft's October 13, 2026 cumulative update notes (KB5127648) still describe the Windows Update deployment as ongoing, so a PC that shows "not yet updated" today may simply be waiting its turn.
What you can do as a home or small-office user is short: keep the PC online, install all Windows updates, restart when asked, and recheck Windows Security after a few days.
Firmware and manufacturer caveats
Microsoft's pages are clear on three points. Some devices need a firmware update from the PC manufacturer before the certificates can be applied. Those updates come through the manufacturer's normal channel, not from Windows Update. And Microsoft recommends updating firmware first, especially on older models, because it reduces the chance of failures.
Not sure what is wrong? Get a diagnosis first.
Our certified tech can connect remotely, check your software, drivers and backups, and tell you honestly whether the problem needs a hands-on repair.
Check the support page of your PC maker (Dell, HP, Lenovo, ASUS, Acer and others each publish their own guidance, and Microsoft publishes a Surface-specific page) for a BIOS or UEFI update and for any statement about Secure Boot certificates. Updates may only exist for models still inside their support period. If your model is out of support, the PC will still work, but the boot-protection gap described above is the trade-off.
One more detail from Microsoft's FAQ: firmware updates change the default Secure Boot variables, while Windows updates change the active ones. It also advises not changing your Secure Boot configuration unless the manufacturer has released firmware defaults that include the new certificates. Resetting the firmware to defaults on a machine that still carries only the old defaults is a common way to create trouble.
BitLocker: back up your recovery key first
Some devices may show a BitLocker recovery prompt after firmware or Secure Boot changes, so keep a copy of your recovery key first. Microsoft's separate boot manager guidance also tells people to keep a copy of the BitLocker recovery key before enabling related mitigations. So before any firmware or Secure Boot change:
- Type "BitLocker" in Start and open Manage BitLocker.
- Choose Back up your recovery key for each drive and save it to your Microsoft account, a file or a printout, as Microsoft's support page describes.
- Confirm you can actually open that copy from another device. A key you cannot reach is no backup.
Many Windows 11 PCs use device encryption that is tied to a Microsoft account, so the key may already be stored there. Verify it rather than assume. If you do lose access, our article on data recovery after a Windows update or reinstall explains what is and is not recoverable, and a separate off-device copy of your files (see cloud backup options) removes most of the stress.
Linux dual-boot and older hardware
The Microsoft UEFI CA 2011 is the certificate that signs third-party boot loaders, which is what many Linux distributions use through a shim. A Microsoft Community Hub post titled "What IT teams need to know about Linux Secure Boot certificates expiring in 2026" covers this directly, and a search snippet of it suggested that systems keep booting and that the 2011 CA should not be removed from the DB. I could not load the full post, so this is unconfirmed: read it yourself and your distribution's own notes before changing anything on a dual-boot machine. Microsoft also notes that the split of the UEFI CA 2023 into a boot loader certificate and an option ROM certificate lets a system trust option ROMs without trusting third-party boot loaders.
What NOT to do
Do not disable Secure Boot. Turning Secure Boot off does not work around certificate expiration, and it removes a layer of protection. Leave it on.
- Do not paste PowerShell or registry scripts from forums or video comments. Firmware variable changes can leave a PC unable to start.
- Do not clear or reset Secure Boot keys unless the manufacturer's firmware defaults already include the 2023 certificates.
- Do not delete the 2011 certificates by hand, especially on a Linux dual-boot.
- Do not ignore a red "Requires action" badge, and do not dismiss warnings on a device that has not been updated.
- Do not start without a BitLocker key backup and a file backup.
If the status stays yellow or red, or a PC will not boot after an update, a remote technician can walk through the firmware and recovery steps with you. See our Windows support and remote repair pages.
FAQ
Will my PC stop working because the Secure Boot certificates expired?
No. Microsoft says devices without the 2023 certificates continue to start and run normally and keep receiving standard Windows updates.
What exactly do I lose if I never update the certificates?
The ability to receive new boot-level protections, such as Boot Manager updates, Secure Boot database and revocation list updates, and fixes for newly discovered boot vulnerabilities.
How do I know if my PC has the new certificates?
Open Windows Security, Device security, Secure Boot. Microsoft says a green check means the device is sufficiently protected and no action is needed. Read the status message on that page for the details.
Do I need to update my BIOS?
Possibly. Microsoft says some devices need a manufacturer firmware update before the certificates can be applied. Check your PC maker's support page for your exact model.
Should I turn Secure Boot off?
No. Microsoft advises against it, and devices with Secure Boot off do not receive the new certificates.
Do I need my BitLocker recovery key?
Back it up first. Microsoft lists recovery prompts as a possible outcome on outdated firmware, and its guidance says to retain a copy of the key before related changes.
Does this affect Windows 10 with ESU?
Microsoft lists Windows 10 among affected versions and says only supported versions get the certificates. I could not confirm ESU specifics on a Microsoft page, so check Microsoft's current guidance.
Does this affect Linux dual-boot?
It can, because third-party boot loaders rely on the Microsoft UEFI CA. Read Microsoft's Linux post and your distribution's guidance, and do not remove the 2011 certificate by hand.