Microsoft Windows Production PCA 2011, the certificate for signing the Windows boot loader, will expire on October 19, 2026. This follows the earlier expiration of two other 2011 certificates in June 2026. PCs without the new certificates will still boot and receive standard updates but will miss out on new security enhancements for the early boot process. The new certificates from 2023 are replacing the 2011 certificates. The KEK certificate, essential for authorizing updates to signature databases, and the Microsoft UEFI CA 2011, which signs third-party boot loaders, will also be replaced by new certificates. Users can check their Secure Boot status through the System Information tool or Windows Security. Microsoft is gradually rolling out the new Secure Boot certificates through Windows Update, and users are advised not to disable Secure Boot to avoid complications. Dell will not issue BIOS updates for platforms that reached their end of service life before January 1, 2026. The transition to Secure Boot has faced challenges for older PCs, and developers are advised against pinning Secure Boot certificates in their applications. Multiple restarts may be required for full integration of the new certificates.