The Secure Boot certificate expiration lands on Monday, October 19, when Microsoft’s Windows Production PCA 2011 certificate runs out. Your PC will still start, but it can stop getting future boot-level security protections if the new certificates aren’t installed. Checking takes about two minutes.
Here are the facts you need up front:
- The certificate that expires is Microsoft Windows Production PCA 2011, on October 19, 2026.
- Two related 2011 certificates already expired in June (June 24 and June 27).
- Your PC should still boot after the date, per Office Digital and the University of Wisconsin IT knowledge base.
- Most PCs get the replacement certificates through Windows Update. Some older ones need a BIOS/UEFI update first.
The point of the list: this is a “check and update” job, not a “your PC is about to die” emergency.
What is actually expiring?
Secure Boot is the UEFI feature that checks your PC only starts software signed by trusted parties. Those checks rely on certificates Microsoft issued back in 2011. They have a built-in end date, and Microsoft has been replacing them with 2023 versions.
Three certificates are involved, and they expire in stages:
| Older certificate | Expires | Replacement |
|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 |
The October one matters most for Windows users, because it signs the Windows boot manager itself.
Will your PC stop booting?
No, not on this date. A certificate’s expiry date doesn’t switch off Secure Boot, and PCs without the new certificates keep starting normally.
The risk is slower. Without the 2023 certificates, a PC may miss future boot manager security updates, Secure Boot database and revocation-list updates, and some BitLocker-related protections. Think of it as falling off the update path for the very first thing your PC loads.
How to check your Secure Boot certificate status
Open Windows Security and look at the Secure Boot status. These steps work on current Windows 11 builds:
- Open Windows Security and go to Device security.
- Find the Secure Boot section.
- Look for the message saying all required certificate updates have been applied.
That message means you’re done. A yellow or red notice means the PC still needs something, and the next section covers what.
What to do if the check shows a warning
Start with Windows Update, since that’s how most PCs receive the new certificates. Windows Latest’s test of the October 2026 update says the same: keep updates on, then check your PC maker for firmware if you’re still not covered.
The October 13 patch is a good place to start. If you skipped it, our guide to KB5127648 and the 24H2 Home and Pro support cutoff covers what it includes.
- Go to Settings, then Windows Update, and install everything available.
- Restart, then recheck Windows Security.
- If a yellow warning remains, look for a BIOS/UEFI update on your PC maker’s support page, for your exact model.
- Keep Secure Boot turned on. Turning it off is not a fix.
One safety step before any firmware update: find your BitLocker recovery key. Firmware and certificate changes can occasionally trigger a recovery prompt, per Office Digital.
What about older or unsupported PCs?
Older machines are where trouble is most likely. If your PC maker has stopped shipping firmware updates, the new certificates may never arrive through the normal route. Microsoft’s own Secure Boot certificate expiration page is the place to look for current guidance.
Don’t download certificate files from random sites or edit Secure Boot databases by hand. That advice is for managed fleets following official instructions, not home PCs.
If you’re also tightening your PC’s defenses, our piece on Windows 11 Memory Integrity turning on by default is a useful companion read.
Frequently Asked Questions
Will my PC stop working on October 19?
No. Sources say PCs keep booting normally. What you risk is missing future boot-level security updates.
How do I know if my PC already has the new certificates?
Open Windows Security, go to Device security, and check the Secure Boot section. It should say all required certificate updates have been applied.
Do I need to update my BIOS?
Only if Windows Update doesn’t finish the job and Windows Security still shows a warning. Use firmware made for your exact PC model.
Should I turn off Secure Boot to avoid problems?
No. Turning it off removes a real protection and doesn’t solve the certificate issue.
The short version
Don’t panic, but don’t ignore it either. Run Windows Update tonight, check the Secure Boot line in Windows Security, and only chase a BIOS update if a warning stays. If your PC is old and the maker has gone quiet, treat that as one more reason to plan a replacement.
Leave a Reply