Several 2011 Microsoft Secure Boot certificates expire in 2026. Microsoft says devices that miss the replacement certificates still boot and still install normal Windows updates, but they stop receiving new early-boot protections. The work is to confirm that both the DB and KEK stores have been updated, and to ask OEMs about firmware.
What expires
Microsoft's support page lists four certificates with dates. The Microsoft Corporation KEK CA 2011 expires on 24 June 2026. The Microsoft UEFI CA 2011 expires on 27 June 2026 and covers third-party boot loaders and option ROMs. The Microsoft Windows Production PCA 2011 expires on 19 October 2026. Each has a 2023 replacement.
Check the page itself for the current table, because Microsoft maintains it and may revise guidance.
What happens if you do nothing
According to Microsoft, an unchanged device keeps booting and keeps getting standard updates. What it loses is new Boot Manager updates, DB and DBX updates, and fixes for newly found boot-level vulnerabilities. Protection weakens over time, and Microsoft says scenarios such as BitLocker hardening and third-party bootloaders can be affected.
That is a slow failure, which is why it gets missed. Nothing breaks on the day.
A checklist for IT teams
- Inventory devices by make, model and firmware version. You cannot reason about this from the OS version alone.
- Check certificate update status in the Windows Security app, or through Intune monitoring if you use it.
- Deploy the update with the method that fits you. Microsoft names registry keys, Group Policy, the WinCS APIs and Intune.
- Update both DB and KEK. Microsoft states both must be updated.
- Pull firmware updates from the device manufacturer where needed.
- Test a pilot group first, including machines that dual boot or use third-party bootloaders.
For device and firmware makers
If you ship UEFI firmware or sign your own boot components, the same clock applies to your supply chain. Microsoft tells manufacturers to follow its OEM guidance and key management guidance for the 2023 certificates. Plan a firmware release, publish which models it covers, and tell customers plainly.
Linux and other third-party boot chains that depend on the UEFI CA should ask their distributor which signed shim they are shipping.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a one-time check differs from a watch that raises a flag when something changes, which is the habit this deadline rewards.
Quick check
Will my PC stop booting after the expiry date?
Microsoft says devices can still boot and run normally. The loss is early-boot protection updates.
Is updating DB enough?
Microsoft states both DB and KEK must be updated.
Where Safeguard fits
Safeguard's asset discovery and compliance evidence automation can help you keep a dated record of which devices were checked and when. It does not read Secure Boot certificate stores itself, so treat that part as your own inventory work.
Sources
Last reviewed: 19 October 2026.
