The Secure Boot certificate that signs the Windows boot loader expired on October 19, 2026, and your PC most likely still starts fine. What changed is that a PC without the new 2023 certificates can no longer get future boot-level security fixes. You can check your status in about a minute, and the fix is usually just Windows Update.
Here are the quick facts before we get into the details:
- The Microsoft Windows Production PCA 2011 certificate expired on October 19, 2026, per Windows Latest.
- Two other 2011 certificates already expired in June 2026.
- Your PC still boots and still gets normal Windows updates.
- Windows 10 PCs need Extended Security Updates (ESU) to receive the new certificates.
- Check Windows Security > Device security > Secure Boot for a green, yellow or red status.
That’s the 10-second version. If your status isn’t green, keep reading, because the next steps depend on the color you see.
What the Secure Boot certificate expiry actually changes
Secure Boot checks the digital signature of everything that loads when your PC starts. That blocks bootkits, a nasty type of malware that runs before Windows does. The signatures rely on certificates, and Microsoft is swapping the 2011 set for 2023 replacements.
According to PCWorld, the Microsoft KEK CA 2011 expired on June 24, 2026, and the Microsoft UEFI CA 2011 expired on June 27, 2026. The last one, the Windows Production PCA 2011, ran out in October. Its replacement is the Windows UEFI CA 2023.
Microsoft says a PC without the new certificates “will still start and operate normally”. The catch is quieter. That PC stops receiving new Boot Manager updates, Secure Boot database updates and revocation lists, the pieces that block threats like BlackLotus.
So nothing breaks today. Your protection just stops improving, and the gap grows as new boot-level threats appear.
How to check your Secure Boot certificate status in one minute
On Windows 11, open Settings, go to Windows Security, then Device security, then Secure Boot. Windows shows a status message there, and it works like a traffic light.
Here is what each message means and what to do about it:
| Status message | What it means | Your next step |
|---|---|---|
| All required certificate updates have been applied | You have the 2023 certificates and the new boot manager (green) | Nothing. You are done. |
| Older boot trust configuration | The update is pending | Install pending Windows updates, then restart |
| Affected by a known issue | Microsoft paused the update for your PC | Wait for a fix and keep Windows updated |
| Hardware or firmware limitations | Your firmware is blocking the change | Check your PC maker for a BIOS update |
| Can no longer receive required updates | The PC is still on an expired certificate | See the older-PC section below |
If you see no Secure Boot section at all, your PC may use Legacy BIOS, have Secure Boot turned off, or run Windows 11 on unsupported hardware through a bypass. Per Microsoft’s FAQ, devices with Secure Boot disabled won’t get the new certificates.
Prefer a command? Windows Central suggests running this in an admin PowerShell window:
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
True means the new certificate is in place. False means you still rely on the old one.
What to do if your Secure Boot status is yellow or red
Start with Windows Update, since that’s how most PCs get the certificates. Microsoft rolls them out in waves, grouping PCs into hardware and firmware buckets, so yours may simply be waiting its turn. PCs that were offline for months should catch up once they reconnect.
If the warning stays, follow these steps in order:
- Install every pending Windows update and restart. You may need a few restarts.
- Open your PC maker’s support page and look for a BIOS or firmware update. Dell, HP, Lenovo, Asus and Acer all have them.
- Back up your BitLocker recovery key before updating firmware. Some HP BIOS updates have triggered BitLocker recovery loops, according to Windows Latest.
- Leave Secure Boot switched on, even if it looks like a quick workaround.
That last point matters most. Microsoft says Secure Boot should not be disabled to work around the expiry, and turning it back on later can leave a PC unable to boot. A BIOS reset to factory defaults is risky too, unless those defaults already include the 2023 certificates.
If you keep your PC patched monthly, you’re already on the right track. Our Windows 11 26H2 guide and the November Patch Tuesday preview cover that routine.
Which older PCs may never get the new Secure Boot certificate
Newer PCs are mostly fine. Older ones are the problem, because some certificates need a firmware change that only the manufacturer can ship.
PCWorld reports that Dell doesn’t provide BIOS updates for systems whose support ended before January 1, 2026. HP excludes PCs from 2018 and earlier, and Lenovo’s situation is similar. If your laptop is that old, a green status may not be possible.
Windows 10 is its own case. Without ESU enrollment, those PCs no longer receive updates, so they won’t get the new certificates. They still boot, but you should weigh whether it’s time to upgrade or enroll.
Frequently Asked Questions
Will my PC stop booting because of the Secure Boot certificate expiry?
No. Microsoft says PCs without the new certificates still start and run normally. You just miss future early-boot security protections.
Should I turn off Secure Boot to avoid problems?
No. Microsoft warns against it, since it weakens protection against boot-level malware. Turning it back on later can also make some PCs fail to boot.
How do I know if I have the Windows UEFI CA 2023 certificate?
Check Windows Security > Device security > Secure Boot for the green message. You can also run the PowerShell check shown above.
Does this affect Windows 10?
Yes. Windows 10 PCs need ESU enrollment to receive the new certificates, and unenrolled PCs won’t get them.
Our take: check it today, but don’t panic
This is a ten-minute chore, not an emergency. Look at your Secure Boot status, install pending updates, and back up your BitLocker key before touching any BIOS update. If you’re on a 2018-era or older PC and the status won’t turn green, that’s a reasonable nudge to plan a replacement, but nothing here requires rushing a risky firmware change tonight.
Leave a Reply