Microsoft Windows Production PCA 2011, the certificate responsible for signing the Windows boot loader, is set to expire on October 19, 2026. This date marks the final significant milestone in Microsoft’s transition to new Secure Boot certificates, following the expiration of two other 2011 certificates earlier this year in June.
Despite the impending expiration, users need not worry about their PCs ceasing to boot. Microsoft reassures that a PC lacking the new certificates will “still start and operate normally,” and will continue to receive standard Windows updates. However, it will no longer benefit from new security enhancements designed for the early boot process.
The last major Secure Boot certificate deadline for Windows arrives October 19
Secure Boot, a feature embedded in UEFI firmware, verifies the signatures of all boot software components—from UEFI drivers to the operating system—prior to initiating the PC. Since the inception of Secure Boot support in Windows, PCs have relied on Microsoft certificates issued in 2011, which are now being replaced by a new set from 2023.
| Old certificate | Expiry | Replacement |
|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023 |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 |
The KEK certificate is essential for authorizing updates to the allowed (DB) and revoked (DBX) signature databases, while the Microsoft UEFI CA 2011 signs third-party boot loaders, EFI applications, and option ROMs. The Windows Production PCA 2011, which signs the Windows Boot Manager, will be succeeded by the Windows UEFI CA 2023, now stored in the DB.
During a June Secure Boot AMA, Microsoft engineers indicated that the company could continue signing boot managers with the old key until October, meaning future Windows boot managers will require the 2023 certificate. Notably, firmware will still trust boot loaders signed before the expiration unless the certificate is included in the DBX revocation list.
Without the 2023 certificates, a PC will miss out on “updates to Windows Boot Manager, Secure Boot databases and revocation lists,” as well as critical fixes for newly discovered boot-chain vulnerabilities. This includes protection against threats like BlackLotus, a 2023 bootkit that managed to bypass Secure Boot on fully updated Windows 11 PCs.
How to check if your Windows 11 PC has the new Secure Boot certificates
The new 2023 certificates are delivered through Windows Update, with Microsoft stating that “in many cases, no action is needed.” To ensure your PC is eligible, it must run a supported version of Windows, have updates unpaused, and have Secure Boot enabled. The status can be verified through the System Information tool (msinfo32) under “Secure Boot State.” For Windows 10 PCs, the certificates are only available with Extended Security Updates (ESU).
To check your Secure Boot status, navigate to Windows Security > Device security > Secure Boot. Since April, Windows 11 has displayed certificate status in this section, with Microsoft providing explanations for each message:
- “All required certificate updates have been applied” indicates completion.
- “Older boot trust configuration” suggests that Windows should automatically update it; users should install any pending updates and restart.
- “Affected by a known issue” means Microsoft has paused updates for the PC until a resolution is implemented.
- “Hardware or firmware limitations” indicates that assistance from the PC manufacturer is required.
- “Can no longer receive required updates” signifies that the PC remains on an expired certificate.
For those receiving yellow or red warnings, it is advisable to consult the support page of your PC manufacturer. Companies like Dell, HP, Lenovo, Asus, and Acer maintain dedicated Secure Boot pages that include BIOS updates. It is also prudent to back up your BitLocker recovery key, as some BIOS updates have previously caused issues, such as entering a BitLocker recovery loop.
Importantly, users should refrain from disabling Secure Boot, as Microsoft cautions against this practice to circumvent certificate expiration. Disabling it could lead to complications when attempting to revert to the 2023-signed boot manager, potentially rendering the PC unbootable if the firmware only recognizes the 2011 certificate.
Microsoft is still rolling out the Secure Boot update after the June deadlines
Microsoft began distributing the update to all eligible PCs just hours before the first certificate expiration and continues to do so. The September 8 update, KB5124008, introduced “additional high confidence device targeting data,” which expanded the update’s reach to more devices. The October 13 update confirmed that Microsoft “will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.”
The rollout may appear gradual due to Microsoft’s high-confidence database, which categorizes PCs based on hardware and firmware. A bucket receives the update only after similar devices have successfully updated. The June update successfully moved most consumer PCs with diagnostic data into the high-confidence group, with Microsoft refreshing this data bi-monthly. Notably, a PC that has been offline for an extended period will still receive the certificates upon reconnection.
It is worth noting that Dell will not issue BIOS updates for platforms that reached their end of service life before January 1, 2026. The transition to Secure Boot has proven challenging for older PCs, with issues such as stuck KEK updates and BitLocker loops arising even with HP’s latest firmware. Certain ASUS, MSI, and ASRock motherboards also faced difficulties with the 2023 updates earlier this year.
Additionally, PCA 2011 is responsible for signing Windows files beyond the boot process. Microsoft’s August code signing document indicates that Windows signing is transitioning to Microsoft Windows Production PCA 2026, with the September 10 Release Preview builds already signed with this new certificate. Developers are advised against pinning Secure Boot certificates within their applications.
Lastly, it is essential not to assume that a single Windows update has completed the process. PCs may require multiple restarts as the certificates are integrated into the firmware, and the presence of a new SecureBoot folder in C:Windows is expected. Microsoft considers a PC fully updated only when it possesses both the 2023 certificates and the new boot manager, which is why the green checkmark should be regarded as the definitive indicator of completion.
