Windows Secure Boot Certificate Expiry: Check 2023 Boot Trust Status Before October 19, 2026

As reported by Windows Latest and detailed across Microsoft Support documentation, this milestone caps off a multi-month cryptographic handover that began when two companion 2011 certificates expired back in June 2026. The good news for anyone staring nervously at their desktop is that Monday is a cryptographic milestone, not a scheduled shutdown. According to Microsoft’s official servicing guidance (KB5079373), a Windows PC that reaches the expiration date without the replacement 2023 certificates will continue to start and operate normally, and standard monthly Windows updates will keep installing.

However, "boots normally" does not mean "business as usual." A system left behind on expired 2011 certificates loses its ability to receive new security protections for the early boot process—including future Windows Boot Manager updates, new trusted signature database (DB) entries, and revocation list (DBX) updates designed to block newly discovered bootkits. Here is a complete technical breakdown of what is expiring, how Windows orchestrates the replacement behind the scenes, and how both home users and enterprise administrators can verify where their machines stand.

The 2011-to-2023 Secure Boot Certificate Handover​

Secure Boot is a UEFI firmware security standard that verifies the cryptographic signature of each piece of pre-boot software—from option ROMs and UEFI drivers to the operating system bootloader—before allowing the machine to start. Since Windows 8 first brought Secure Boot into the mainstream, the PC ecosystem has relied on a root set of Microsoft certificates issued in 2011.

Because cryptographic keys are not meant to live forever, Microsoft has been transitioning the ecosystem to a 2023 certificate generation. Each certificate plays a distinct role inside your motherboard’s Non-Volatile RAM (NVRAM):

As documented in Microsoft Learn’s Secure Boot architecture notes, renewing the Microsoft UEFI CA 2011 certificate also allowed Microsoft to split third-party trust into two separate 2023 certificates: one for third-party bootloaders and EFI applications, and another strictly for Option ROMs. That separation gives system builders and security-conscious administrators finer control, allowing a machine to trust third-party hardware Option ROMs without automatically trusting every third-party bootloader signed under the broader certificate.

Why did Microsoft Windows Production PCA 2011 outlast the June deadlines by nearly four months? Because its issue and expiry dates fell in October, Microsoft engineers noted during a June Secure Boot AMA (as cited by Windows Latest) that the company could continue signing Windows Boot Managers with the 2011 key until October 19. UEFI firmware continues to trust a bootloader that was signed prior to the certificate's expiration date unless that certificate or specific binary hash is explicitly added to the DBX revocation list. Once Monday passes, however, newly issued Windows Boot Managers addressing future boot-chain vulnerabilities will require trust anchored in Windows UEFI CA 2023.

Outside the UEFI pre-boot environment, Windows Latest also notes that Microsoft’s August 2026 code-signing documentation transitions non-boot Windows binary signing to Microsoft Windows Production PCA 2026, which already began appearing in September Release Preview builds 26100.9539 and 26200.9539, alongside guidance advising developers not to hard-code or pin the Secure Boot certificates inside applications.

Section Summary​

• October 19, 2026 marks the expiration of Microsoft Windows Production PCA 2011, which signs the Windows Boot Manager.
• Its replacement, Windows UEFI CA 2023, resides in the UEFI allowed signature database (DB).
• Two other 2011 certificates (Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011) already expired in late June 2026.

What Happens If Your PC Misses the October 19 Deadline?​

If your PC crosses into October 20 without Windows UEFI CA 2023 and the updated boot manager installed, you will not wake up to a black screen. Microsoft Support document KB5079373 ("When Secure Boot certificates expire on Windows devices") lays out the exact boundaries between what keeps working and what stops:

What Continues to Work​

• Normal Startup: The PC continues to boot into Windows normally.
• Standard Servicing: Monthly Windows quality, feature, and security updates continue to download and install—except for pre-boot security components that require the 2023 signing chain.
• Everyday Computing: Applications, web browsing, networking, and standard OS features are completely unaffected.
• Existing Pre-Boot Protections: Secure Boot remains active and continues blocking previously known threats that are already listed in your current DBX revocation database.

What Stops Working​

• New Boot Manager Updates: Your PC can no longer apply newly signed updates to the Windows Boot Manager.
• Future DB and DBX Updates: The system cannot receive new Secure Boot allowed database (DB) entries or revocation list (DBX) updates.
• Early-Boot Vulnerability Mitigations: Fixes for newly discovered vulnerabilities in the boot chain—such as BitLocker pre-boot bypass mitigations or revocations for newly discovered bootkits—cannot be applied. (From a broader security perspective, bootkits like the 2023 BlackLotus malware demonstrated why timely DBX revocations and bootloader updates are critical, as attackers specifically target outdated but validly signed bootloaders to hijack the OS before kernel defenses initialize.)
• Dependent Pre-Boot Components: Scenarios relying on updated Secure Boot trust, including boot-level code integrity, BitLocker hardening, or third-party bootloaders and Option ROMs that transition to 2023 certificates, may eventually fail to update or load.

In short, an unupdated PC enters a state of gradual security decay rather than immediate failure.

How to Check Your Secure Boot Certificate Status in Windows 11​

For most home and unmanaged business PCs, Microsoft delivers the 2023 certificates automatically through Windows Update. However, Microsoft uses a phased rollout backed by "high-confidence device targeting data"—grouping systems by hardware and firmware telemetry to verify that updates succeed before opening the floodgates to identical configurations. For instance, the September 8, 2026 cumulative update KB5124008 (OS Builds 26200.9445 and 26100.9445 for Windows 11 versions 25H2 and 24H2) specifically expanded this high-confidence targeting database to unlock automatic certificate delivery for more devices.

To see where your machine stands right now, you do not need to dig into PowerShell first. Starting in April 2026 (KB5087130), Microsoft added a dedicated certificate status readout to the Windows Security app.

Step 1: Verify Secure Boot Is Enabled​

1. Press Win + R, type msinfo32, and press Enter to open System Information.
2. In the System Summary pane, locate BIOS Mode (which should read UEFI) and Secure Boot State (which should read On).
3. Ensure you are running a supported version of Windows with Windows Update unpaused. (Per Microsoft's servicing scope in KB5079373 and KB5087135, supported platforms include active Windows 11 releases, Windows 10 LTSC editions, Windows 10 devices enrolled in Extended Security Updates, and supported Windows Server releases.)

Step 2: Inspect the Windows Security App​

1. Open Windows Security.
2. Navigate to Device security > Secure Boot.
3. Read both the icon badge and the exact status message text.

Microsoft explicitly warns in KB5087130 that a green checkmark icon by itself does not prove your certificates are updated, because older versions of the interface used a green badge simply to show that Secure Boot was turned on. Furthermore, Microsoft defines a PC as "Fully updated" only when both the 2023 certificates and the 2023-signed Boot Manager have been applied.

Here is how to translate the official status messages documented by Microsoft:

• "Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed." (Green checkmark)
  • Meaning: Both the 2023 UEFI certificates and the updated Windows Boot Manager are installed. You are completely done.
• "Secure Boot is on, but your device is using an older boot trust configuration that should be updated." (Yellow badge or informational state)
  • Meaning: Your PC is still on the 2011 chain, and Windows expects to update it automatically. Install all pending Windows Updates, keep the PC connected to the internet, and restart when prompted.
• "Secure Boot is on, but your device is using an older boot trust configuration that should be updated. There is not yet enough data to classify your device for automatic update."
  • Meaning: Your hardware/firmware bucket is still awaiting validation in Microsoft’s high-confidence targeting database. Keep installing monthly cumulative updates as Microsoft expands targeting coverage.
• "Secure Boot is on, but your device is affected by a known issue. To reduce risk, Secure Boot certificate updates are temporarily paused while Microsoft and partners work toward a supported resolution."
  • Meaning: Microsoft placed a safeguard hold on your hardware/firmware configuration. Leave Secure Boot alone; the update will resume automatically once an OEM firmware update or Windows fix clears the block.
• "Secure Boot is on, but your device does not support the automated Secure Boot certificate update due to hardware or firmware limitations. Contact your device manufacturer for assistance." (Yellow caution badge)
  • Meaning: Windows cannot write the new keys into NVRAM on its own because of a BIOS defect or platform limitation. You must check your PC or motherboard manufacturer’s support page (such as Dell, HP, Lenovo, ASUS, or Acer) for a UEFI/BIOS update. Note that some older hardware that has passed its OEM end-of-service life may never receive a BIOS update.
• "Secure Boot is on, but this device can no longer receive required updates for the Windows boot experience." (Red stop badge — Requires action)
  • Meaning: Your PC remains on an expired certificate after the deadline and a boot-chain security update exists that cannot be applied to your configuration.

Critical Warnings: What NOT to Do​

When troubleshooting a yellow or red warning in Windows Security, well-meaning tinkering in the UEFI menu can turn a harmless certificate warning into a machine that refuses to boot. Microsoft’s Secure Boot troubleshooting guide gives two strict warnings that every user and technician should heed:

1. Never disable Secure Boot to "work around" certificate expiration. Disabling Secure Boot strips away pre-boot malware protections and does not solve the underlying issue. Worse, if a system has already transitioned its boot partition to the Windows UEFI CA 2023-signed boot manager while firmware only trusts the 2011 certificate, re-enabling Secure Boot later can leave the PC unable to boot.
2. Do not blindly reset BIOS/UEFI Secure Boot keys to "Factory Defaults." If Windows has already updated your Windows Boot Manager on disk to the 2023-signed version, resetting your motherboard's Secure Boot databases to factory defaults will wipe the 2023 certificates out of NVRAM unless your OEM's factory defaults already include the 2023 keys. Without Windows UEFI CA 2023 in the DB, the firmware will reject the 2023-signed Windows Boot Manager and block startup.
3. Always back up your BitLocker recovery key before updating BIOS or touching Secure Boot. Microsoft notes in its troubleshooting guide that during the first boot after a Secure Boot update, some firmware implementations fail to report the updated Secure Boot PCR values in time when Windows attempts to reseal BitLocker. That temporary mismatch in measured boot values triggers a BitLocker recovery prompt (which typically resolves and reseals cleanly on the very next reboot). Have your 48-digit BitLocker recovery key saved outside the PC before flashing any OEM BIOS update.

Under the Hood: A Technical Guide for IT Administrators​

If you manage enterprise Windows 10, Windows 11, or Windows Server fleets, you might open Windows Security > Device security > Secure Boot on a domain-joined workstation and wonder why the new certificate status indicators are nowhere to be found.

1. Why the UI Status Is Hidden on Managed PCs (and How to Enable It)​

According to Microsoft’s IT admin guide: Secure Boot certificate update status in the Windows Security app (KB5087135), the new Secure Boot certificate status badges and notifications are disabled by default on enterprise-managed client devices and Windows Server (2019, 2022, and 2025) to prevent helpdesk noise while admins manage rollouts centrally. (On Windows Server with Desktop Experience, the Windows Security notification service also does not start automatically.)

If you want to expose the Secure Boot certificate status indicators in the Windows Security UI on managed endpoints, configure the following registry value via Group Policy or Microsoft Intune:

• Registry Subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security
• Value Name: HideSecureBootStates
• Type: REG_DWORD
• Data:
  • 0 = Enabled (Show Secure Boot certificate status and badges)
  • 1 = Disabled (Hide Secure Boot certificate status)
  • Not present = Default (Enabled on unmanaged Home/Pro; Disabled on Enterprise-managed and Server)

2. How Windows Actually Applies the Certificates​

Rather than flashing all certificates in a single monolithic reboot, Windows coordinates with UEFI firmware through a sequential state machine documented in Microsoft’s Secure Boot troubleshooting guide:

• The Scheduled Task: Windows uses the scheduled task \Microsoft\Windows\PI\Secure-Boot-Update (running as Local System). By default, it executes at system startup and every 12 hours thereafter. If an administrator or third-party "debloat" script disables this task, Secure Boot certificate updates will stall completely.
• Sequential Bitmask Processing: The task reads pending work from the AvailableUpdates registry bitmask (while enterprise policy state is tracked separately in AvailableUpdatesPolicy). It applies one step at a time—writing UEFI variables to DB or KEK, or staging the new boot manager—and clears the corresponding bit only after the step succeeds and logs an entry in the System event log. Because of this staged validation, a PC may require multiple restarts and several 12-hour task cycles before reaching the final green state. You may also notice a new C:\Windows\SecureBoot directory created during servicing, which is normal behavior.
• Key Bitmask Flags:
  • 0x4000 (Modifier flag): Instructs the task to apply Microsoft UEFI CA 2023 (0x0800 / 0x1000 conditional steps) and Microsoft Option ROM UEFI CA 2023 only if the device’s DB already contains Microsoft Corporation UEFI CA 2011. This preserves the security posture of locked-down devices that never trusted third-party UEFI binaries in the first place.
  • 0x0100: Instructs the scheduled task to deploy the Windows UEFI CA 2023–signed boot manager to the boot partition, replacing the Microsoft Windows Production PCA 2011–signed boot manager.
• Diagnostic Registry Values: Administrators auditing progress across a fleet can inspect UEFICA2023Status, UEFICA2023Error, and UEFICA2023ErrorEvent alongside the System event log (referenced in KB5016061) to pinpoint whether a device is progressing normally or failing on a KEK update due to missing OEM Platform Key (PK) authorization.
• Hyper-V and Image Deployment Gotchas:
  • For Hyper-V Guest VMs, Microsoft notes that Secure Boot certificate updates require the March 2026 (or later) Windows updates to be installed on both the Hyper-V host and the guest OS.
  • For Dynamic Updates to Windows Installation Media, KB5124008 warns that administrators servicing existing Windows images must ensure the boot.stl file (matching the target OS version and x64/Arm64 architecture) is included in the installation media; omitting it can trigger Secure Boot validation failure 0xc0430001.

Section Summary​

• Enterprise-managed clients hide the new Secure Boot UI badges by default; set HideSecureBootStates (REG_DWORD) to 0 under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security to turn them on.
• Ensure the \Microsoft\Windows\PI\Secure-Boot-Update scheduled task remains enabled so Windows can process the AvailableUpdates bitmask every 12 hours and across reboots.
• Keep BitLocker recovery keys handy before applying OEM BIOS updates, leave Secure Boot enabled, and let Windows complete both the certificate injection and the Boot Manager transition.