The Secure Boot certificate that signs the Windows boot loader expired on October 19, 2026. Your PC still starts and runs, but if it missed the replacement, it can’t get new protection for the earliest stage of startup. Here’s how to check yours in about a minute.
Quick facts:
- The expired certificate is Microsoft Windows Production PCA 2011, which signs the Windows Boot Manager.
- The replacement is Windows UEFI CA 2023, delivered through Windows Update.
- Windows 10 PCs only get it with Extended Security Updates (ESU).
- Check yours at Windows Security > Device security > Secure Boot.
That list is the short version. The rest of this post covers what each status message means and what to do about it.
What actually expired on October 19?
According to Windows Latest, the Windows Production PCA 2011 certificate was the last major piece of Microsoft’s 2026 Secure Boot certificate transition. Two other certificates expired earlier in the summer.
Think of these certificates as ID badges that the PC’s firmware checks before it lets startup code run. The old badges ran out. New ones, issued in 2023, take over.
| Old certificate | Expired | Replacement |
|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 and Option ROM UEFI CA 2023 |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 |
The table shows why this took months. Microsoft had to replace three links in the chain, and each one needed its own rollout.
What happens if your PC missed the update
Not much, at least on day one. Your PC boots, and regular Windows updates keep installing. Nothing suddenly breaks.
The risk is quieter. A PC on an expired certificate can’t receive new fixes for the boot chain, including updates to the Windows Boot Manager and Secure Boot revocation lists. If someone finds a new startup-level flaw, that PC can’t be protected against it.
Microsoft is also moving Windows signing to a newer Windows Production PCA 2026. Windows Latest says the September 10 Release Preview builds, 26100.9539 and 26200.9539, are already signed with it.
How to check your Secure Boot certificate status
Open Windows Security, choose Device security, then select Secure Boot. Windows shows one of several messages, and each has a clear next step.
| Message you see | What it means | What to do |
|---|---|---|
| All required certificate updates have been applied | You’re done. | Nothing. |
| Older boot trust configuration | The new certificates aren’t installed yet. | Install pending updates and restart. |
| Affected by a known issue | Microsoft paused the update for your PC. | Wait for a fix. |
| Hardware or firmware limitations | Your firmware can’t take the update as is. | Contact your PC maker. |
| Can no longer receive required updates | Your PC is on an expired certificate. | Check for a BIOS update. |
If the Secure Boot section is missing, one of three things is likely true. The PC uses legacy BIOS, Secure Boot is turned off, or Windows 11 is running on unsupported hardware through a bypass.
You can also run msinfo32 and look at “Secure Boot State” to confirm it’s on.
How to get the new certificates
For most people, you just need Windows Update. Make sure updates aren’t paused, Secure Boot is on, and you’re on a supported version of Windows. Microsoft says it will keep delivering the new certificates to eligible PCs, and PCs that were offline for months get them once they reconnect.
The rollout is staged by hardware and firmware group, so a friend’s laptop may get it before yours. That’s normal.
If you’re still on an older release, our guide to Windows 11 23H2 end of support explains the deadline for moving up. Our KB5127936 breakdown covers another recent Windows 11 update.
Two mistakes to avoid
First, don’t turn Secure Boot off to dodge the problem. Microsoft says it shouldn’t be disabled as a workaround, and turning it back on later can leave a PC unbootable if its firmware trusts only the 2011 certificate.
Second, back up your BitLocker recovery key before you install any BIOS update. Windows Latest notes that some HP BIOS updates in April caused BitLocker recovery loops. Dell, it adds, won’t release BIOS updates for platforms that reached end of service life before January 1, 2026.
Frequently Asked Questions
Will my PC stop booting because the certificate expired?
No. According to Windows Latest, the PC keeps starting and running normally. It just can’t get new early-boot protections.
Does this affect Windows 10?
Yes. Windows 10 PCs get the new certificates only if they’re enrolled in Extended Security Updates.
How do I know if Secure Boot is turned on?
Run msinfo32 and check “Secure Boot State.” It should say On. If it says Off or Unsupported, the certificate update can’t apply.
What if my PC is old and the maker has stopped updates?
Check the maker’s support page first. If no BIOS update exists, your PC may stay on the old certificate. It will still run, but you should treat it as a reason to plan a replacement.
Our take
Check this today, and don’t panic. For most Windows 11 PCs the fix arrives on its own, so the real job is confirming it did. If you see a yellow or red warning, back up your BitLocker key, look for a BIOS update, and leave Secure Boot switched on. If your PC maker has dropped support, start planning an upgrade rather than hoping for a patch.
Leave a Reply