The Secure Boot certificates installed in most Windows PCs since 2011 are expiring this month. The first deadline is 24 June 2026. Your computer will not stop working. But if the certificate update fails silently, your machine will gradually lose the ability to receive boot-level security patches — without any obvious sign that something has gone wrong.
What is actually expiring
Secure Boot has been a standard feature on Windows PCs since 2011. It runs before the operating system starts loading, and its job is to verify that the boot software has been signed by a trusted party — so if malware tries to insert itself into the startup process, the firmware blocks it before Windows even gets going.
The trust chain works through cryptographic certificates built into your motherboard firmware. The certificates issued in 2011 are now reaching the end of their planned lifespan. Three specific certificates are involved, expiring on different dates:
| Certificate | Expiry date | What it covers |
|---|---|---|
| Microsoft Corporation KEK CA 2011 | 24 June 2026 | Key Exchange Key — used to update Secure Boot databases |
| Microsoft Corporation UEFI CA 2011 | 27 June 2026 | Validates third-party UEFI drivers and boot components |
| Windows Production PCA 2011 | 19 October 2026 | Signs the Windows Boot Manager itself |
Microsoft is replacing these with a 2023-dated set of certificates, valid through 2038. The rollout is happening through standard Windows Update.
What actually happens if your PC misses the update
This is where most of the confusion comes from. The alarming version — that Windows PCs will refuse to boot on June 24 — is wrong. Microsoft has been explicit about this in its published guidance and in two public AMA sessions it held for IT administrators earlier in 2026.
The accurate version is more nuanced. If your machine does not receive the new 2023 certificates, it will continue to start, run, and receive standard Windows updates. What changes gradually is its boot-level security posture. Specifically:
- Microsoft will stop signing new boot-critical components using the 2011 certificates. Any future Windows Boot Manager updates will be signed with the 2023 certificates — and a machine that has not adopted those certificates will be unable to install them.
- DBX revocation lists — the blacklist that tells Secure Boot which malicious boot components to block — will no longer reach the machine. Known bootkits and UEFI malware will remain unblocked.
- Future Windows feature updates may eventually become uninstallable if they rely on the updated boot signing chain.
None of this happens on a specific date. The degradation is gradual. But it is real, and it compounds over time. A machine that misses the certificate refresh will drift further from the security baseline with each passing month.
How to check whether your PC has the update
Microsoft added a clear status indicator to Windows Security with the April 2026 cumulative update. If you are running an up-to-date Windows 11 system, it takes about 30 seconds to check.
- Open Windows Security — search for it in the Start menu, or go to
Settings → Privacy & Security → Windows Security. - Click Device Security in the left panel.
- Scroll to the Secure Boot section. You will see one of three status indicators.
Green — all clear
Secure Boot is enabled and the 2023 certificates have been applied. Nothing further required.
Yellow — not yet updated
The update has not completed. Follow the on-screen instructions. Usually means running Windows Update and allowing a full reboot cycle.
Red — action required
The update cannot complete automatically. Your firmware may need a manufacturer update before the certificate can be installed.
One important caveat from Microsoft: a green checkmark alone does not confirm the new 2023 certificates have been applied — it confirms Secure Boot is enabled. On older hardware, it is worth checking the Device Security panel specifically for the certificate status message, not just the Secure Boot toggle.
Who needs to take action manually
Most Windows 11 users with automatic updates enabled will get through this without touching anything. The update rolls out through standard monthly cumulative updates — the June 2026 Patch Tuesday release is expected to move the majority of mainstream devices into what Microsoft calls the “high-confidence” deployment category, meaning they receive the certificate update automatically.
The exceptions are:
Older PCs with outdated firmware
Some UEFI firmware implementations from older machines do not support the new certificate format cleanly. In these cases, the Windows Update step can complete, but the firmware cannot accept the new certificate until the OEM releases a BIOS update. If your machine shows a yellow or red warning, check your PC manufacturer’s support page for a firmware update. This is especially relevant for systems built before 2018.
PCs with Windows Update paused or disabled
The certificate is distributed via Windows Update. If updates are paused — whether deliberately or through a corporate IT policy — the machine will not receive the certificate. Resume updates, install the latest cumulative update, and allow the machine to restart fully. The process typically requires more than one reboot.
Windows 10 machines not enrolled in Extended Security Updates
This is the group with the most exposure. Microsoft has confirmed that the new Secure Boot certificates are being delivered to supported Windows versions only. Windows 10 reached end of life in October 2025. Machines running Windows 10 outside of the Extended Security Update programme will not receive the certificate update through Windows Update.
If your machine can run Windows 11, the straightforward fix is upgrading now rather than staying on an unsupported OS that is also now drifting away from the Secure Boot security baseline. The free upgrade from Windows 10 to Windows 11 is still available for eligible hardware — check with Microsoft’s PC Health Check tool.
Windows 11 Home
Perpetual licence. Instant delivery. For personal PCs not joining a business domain.
£34Windows 11 Pro
Perpetual licence. Adds BitLocker, Remote Desktop, and Hyper-V.
£38The October 2026 deadline matters too
Most coverage has focused on June 2026 because that is when the first certificates expire. The October deadline is worth flagging separately. The Windows Production PCA 2011 certificate — the one that signs the Windows Boot Manager itself — does not expire until 19 October 2026.
What this means practically: if your machine is in a yellow state in June and you do not address it, the risk escalates further in October. The KEK certificate handles Secure Boot database updates; the PCA certificate handles the boot manager signing chain. Losing both means losing the ability to update or verify both the firmware trust store and the boot software itself.
The June deadline is the more urgent one for most users. But October is not a distant fallback — it is four months away from the time of writing, and it completes the picture. Machines still running 2011 certificates by October will have a meaningfully degraded security posture from which recovery requires manual firmware intervention.
What not to do
A few things are worth stating plainly because they are being passed around as advice:
Do not disable Secure Boot. Some anti-cheat software and older applications prompt users to disable Secure Boot, and this deadline has prompted some sites to suggest disabling it as a way to “avoid” the certificate issue. This is the wrong move. Disabling Secure Boot removes the protection entirely rather than updating it. The right response to a certificate warning is to update the certificate, not switch Secure Boot off.
Do not panic about the SecureBoot folder in Windows. The May 2026 cumulative update (KB5089549) created a folder at C:\Windows\SecureBoot containing example PowerShell scripts. These are intended for IT administrators and are not malware. Numerous reports appeared treating the folder as suspicious — it is not.
Do not use the PowerShell registry workaround on a production machine unless you know what you are doing. There is a registry key method to force the certificate update on devices that are not yet in the automated deployment wave. It exists for IT teams running controlled pilots. On a home PC or business workstation that is not part of an IT fleet, the right approach is Windows Update plus, if needed, an OEM firmware update.
Frequently asked questions
Gary Walsh is the Head of Tech Support at Software Supplies, with more than 20 years in the IT industry. Fully Microsoft-certified and experienced across the full business software stack — from Windows and Office to cloud infrastructure and device management — Gary delivers practical, no-nonsense advice that helps users and businesses get the most from their technology.
