Secure Boot Certificates Expired in 2026: How to Check Your Windows PC Got the Update
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A summary of three Microsoft Support pages on the Secure Boot certificate update (linked below), checked October 29, 2026. This is for personal and small-office PCs that get updates straight from Microsoft. If an IT department manages your PC, follow its guidance and Microsoft's separate IT-managed article.
Secure Boot is the firmware feature that makes sure a PC starts only trusted software, which helps block malware that loads before Windows does. It relies on Microsoft certificates first issued in 2011, and those have now reached their expiration dates. Microsoft has been replacing them with 2023 versions through Windows Update.
For most people, it has already happened in the background. Here's how to confirm yours did.
Which certificates, and when
From Microsoft's certificate expiration page:
| Expiring certificate | Expired | Replaced by | What it does |
|---|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 | Signs updates to the Secure Boot databases |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023 | Signs third-party boot loaders, and separately option ROMs |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 | Signs the Windows boot loader |
What happens if a PC didn't get them
Microsoft says devices without the 2023 certificates will continue to start and operate normally, and standard Windows updates keep installing. The catch: they can no longer receive new security protections for the early boot process, such as Windows Boot Manager and Secure Boot updates. Microsoft also warns of possible compatibility issues later as newer software expects the new certificates.
So this isn't an "it stops working" deadline. It's a "quietly falls behind on boot security" problem.
Step 1: check that the basics are in place
Microsoft's home-user page lists three things:
- A supported version of Windows. Windows 10 support ended October 14, 2025; to keep getting security updates, including for Secure Boot, a Windows 10 PC needs the Extended Security Updates (ESU) program. See Windows 10 end of support.
- Windows updates aren't paused.
- Secure Boot is on. Press Windows + R, type msinfo32, press Enter, and look for Secure Boot State. "On" is what you want. If it's off, Microsoft says to check with the PC maker about firmware support before changing settings; see also turning on TPM 2.0 and Secure Boot.
Step 2: read the status in Windows Security
Since April 2026, the Windows Security app shows certificate status under Windows Security > Device security > Secure Boot, according to Microsoft's Windows Security status page. A badge on the icon tells you where you stand:
- Green: protected, nothing to do.
- Yellow: a recommendation, often a hardware or firmware limit that blocks the automatic update.
- Red: needs attention. A boot security fix exists that can't be delivered to the device's current setup.
Don't stop at the checkmark. Microsoft notes that a green checkmark alone doesn't confirm the certificates were updated. Look for this exact text:
"Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed."
Other messages and what Microsoft says to do:
| Message says… | What to do |
|---|---|
| …using an older boot trust configuration that should be updated | Install the latest Windows updates; restart if prompted |
| …affected by a known issue; updates temporarily paused | Nothing; it resumes automatically |
| …not yet enough data to classify your device | Visit aka.ms/getsecureboot |
| …does not support the automated update due to hardware or firmware limitations | Contact the device manufacturer |
| …can no longer receive required updates… still using an old certificate after the expiration dates | Visit aka.ms/getsecureboot |
Microsoft advises against dismissing the warnings if the device hasn't received the new certificates.
If something goes wrong after the update
Microsoft says that in a few cases a PC might not start, or might ask for a BitLocker recovery key, after receiving the new certificates:
- BitLocker recovery screen: type the 48-digit recovery key (hyphens optional). Where to find it is covered in turning on disk encryption and saving the recovery key. Find it before you need it.
- Won't start: Microsoft says you might need to disable Secure Boot in the firmware menu (often reached with F1, F2, F12 or Esc at startup, or from Windows via Shift + Restart > Troubleshoot > Advanced Options > UEFI Firmware Settings). Contact the PC maker if you're unsure.
Quick checklist
- Windows 11, or Windows 10 enrolled in ESU
- Updates not paused; latest updates installed
- msinfo32 shows Secure Boot State: On
- Windows Security shows "all required certificate updates have been applied"
- BitLocker recovery key saved somewhere other than the PC