The first of Microsoft’s four Secure Boot certificates issued in 2011 expired on June 24, 2026. According to Windows Update data cited by several outlets, nearly all active Windows 10 and 11 PCs have already received their replacements, but the remaining machines still need to be checked.
🔑 Key Takeaways
- The Microsoft KEK CA 2011 expired on June 24, 2026, followed by the Microsoft UEFI CA 2011 (June 27) and the Windows Production PCA 2011 (October 19, 2026).
- Devices that are not updated keep booting and running normally, but no longer receive early-boot protections.
- Most users will be updated automatically through the monthly Windows update, and Copilot+ PCs built in 2025 or later already ship with the new certificates.
- Status can be checked in Windows Security or with PowerShell; Microsoft advises against disabling Secure Boot and recommends backing up BitLocker recovery keys.
Secure Boot: a chain of trust built on certificates
Secure Boot is a feature of the UEFI (Unified Extensible Firmware Interface) firmware that initializes the machine before the operating system loads. Introduced with Windows 8 in 2012, it verifies the digital signature of every component loaded at startup, blocking bootkits, malware that runs before the OS and can evade conventional antivirus tools.
The protection relies on a chain of cryptographic certificates stored in the firmware. Three elements play a central role:
- The Key Enrollment Key (KEK) signs updates to the database of authorized signatures (db) and the list of revoked signatures (dbx).
- The Windows UEFI CA signs the Windows boot loader.
- The Microsoft UEFI CA validates third-party boot loaders and EFI applications.
These certificates were issued in 2011 with a fifteen-year lifespan. Without renewal, Microsoft could no longer publish updates for the boot manager, the Secure Boot databases or the revocation lists, weakening defenses against threats discovered after expiration.
Four certificates, four deadlines
Microsoft has reissued each of these certificates with 2023 versions. The first to lapse is the KEK, on June 24, 2026. The table below summarizes the schedule and the replacements.
| 2011 Certificate | Expiration | 2023 Replacement | Role |
|---|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 | Signs updates to db and dbx |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 | Third-party boot loaders and EFI applications |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft Option ROM UEFI CA 2023 | Third-party option ROMs |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 | Windows boot loader |
The split between third-party boot loaders and option ROMs (firmware embedded in expansion cards) lets organizations trust the latter without extending the same trust to the former. Most new certificates will expire in 2038, with the exception of the Windows UEFI CA 2023, which runs until June 2035.
A largely automated migration, unevenly distributed
For most users, the transition should be invisible. Microsoft says consumers and organizations that let it manage updates will receive the new certificates automatically through the monthly Windows update, with no manual step required. The progressive rollout began in 2024, and according to Windows Update data cited by several sources, nearly all active Windows 10 and 11 PCs have already received the updated certificates.
Device makers have also done their part. Dell, HP, Lenovo, ASUS and Microsoft Surface have pre-provisioned the new certificates on machines shipped since 2024. Copilot+ PCs built in 2025 or later include the 2023 certificates and require no action.
A senior IT director, relayed on sysadmin forums on Reddit, put the stakes bluntly:
« This is not like a typical security patch you can roll out next week. If your machines are not updated before the certificate expires, you risk boot failures across your entire organization. »
Enterprise IT director, name not disclosed, relayed on Reddit
Linux and edge cases
Several distributions, including Ubuntu and Fedora, rely on the same certificate infrastructure to maintain Secure Boot compatibility. Ubuntu has pushed certificate updates through its standard package manager, while Fedora has issued special advisories urging users to update before the deadline.
Users who wiped Windows entirely and run only Linux may not receive the updates automatically. They can contact their device manufacturer or disable Secure Boot, an option Microsoft generally discourages. Macs are not affected.
Checking your PC and protecting your data
Several methods let you verify a device’s status. The Windows Security app, under the Device security page, shows whether all required certificates are applied; a missing certificate triggers a yellow or red icon beneath the Secure Boot entry. For a more detailed check, run PowerShell as administrator:
| Method | Location or command | Expected result |
|---|---|---|
| Windows Security | Device security page, Secure Boot entry | No yellow or red icon |
| PowerShell (administrator) | Get-SecureBootUEFI db | Windows UEFI CA 2023 string present |
| PowerShell (administrator) | Get-SecureBootUEFI KEK | Microsoft Corporation KEK 2K CA 2023 string present |
Microsoft has also released a compatibility check tool that scans for potential issues. A device without the new certificates will keep booting and running normally, and standard Windows updates will continue to install. It will, however, stop receiving early-boot protections: boot manager updates, Secure Boot database updates, revocation lists and fixes for boot-loader vulnerabilities. Scenarios that depend on Secure Boot trust, such as BitLocker hardening or third-party boot loaders, may also be affected.
A cryptography expert quoted on Twitter pointed to the structural weakness of the model:
“That’s what happens when you build critical infrastructure with fixed expiration dates. It works fine until everyone has to rotate keys at the same time.”
Cryptography expert, name not disclosed, quoted on Twitter
Microsoft advises against disabling Secure Boot to work around certificate issues, since that sharply reduces protection and removes safeguards against bootkit-class malware. Disabling it can also block access to BitLocker-encrypted drives without the recovery key, so Microsoft strongly recommends saving a copy of the BitLocker recovery key before the deadline. The recommended sequence is:
- Check the device status in Windows Security or with PowerShell.
- Back up the BitLocker recovery key.
- Keep Windows Update enabled and install the latest monthly update.
- Contact the device manufacturer if the status remains incomplete.
Outlook and scenarios
Given the scale of deployment, the most likely outcome is a migration completed without a notable incident. Three scenarios frame the coming months. In the base case, automatic rollout finishes without significant disruption. In an intermediate case, a minority of older or misconfigured machines, particularly in enterprise fleets, remain without early-boot protection for several months. In the adverse case, a boot-loader vulnerability is exploited before a fix can reach unmigrated devices.
The broader lesson concerns key lifecycle management. A fixed expiration date on a certificate deployed across more than a billion PCs using Secure Boot turns a calendar entry into an operational risk. Microsoft’s KB 5062710, published on June 26, 2025 and updated through May 2026, remains the most complete technical reference on the subject.
Sources
- ZDNet: Secure Boot certificate updates expiring 2026
- TechBuzz: Billion Windows PCs face critical security certificate expiration
- Microsoft Learn: Windows 11 Secure Boot is expiring
- Microsoft Support: Windows Secure Boot certificate expiration and CA updates
- ASUS Support: Secure Boot FAQ
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
