Secure Boot Certificates Expired: What It Means (2026)

KeyStarter Editorial Team
Windows security & licensing · every fact traced to Microsoft KB or Learn pages, re-checked monthly

GUIDE · WINDOWS SECURITY

Secure Boot certificates just expired — what it means for your PC

The 2011 certificates that sign Windows boot components ran out in 2026. Most PCs already carry the 2023 replacements — one check confirms yours.

✓ Microsoft KB5062710 verified✓ Dates from official announcements✓ Re-checked monthly

Oct 19

PCA 2011 expiry — the boot-loader certificate

2023

replacement certificates, shipped since

2039+

new certificates valid through

Quick Answer

Quick answer: the 2011 certificates that sign Windows boot components have run out — Windows Production PCA 2011 expired October 19, 2026. Nothing breaks: an out-of-date PC still starts and installs standard updates, but it can no longer receive new early-boot security protections. Most PCs already carry the 2023 replacements via Windows Update — the check below takes 30 seconds.

This is not a doomsday deadline like Windows 10’s October 2025 cutoff. It is a maintenance event with a quiet failure mode: the PC that misses the rollout keeps working — and quietly stops being protectable at the one stage of boot where malware like BlackLotus used to live.

ON THIS PAGE

01 What exactly expired in 2026?    02 Is your PC actually affected?
03 What happens to a PC that never updates?    04 Getting the 2023 certificates installed
05 How to check Secure Boot on your PC    06 FAQ

Who this is for. ✓ Anyone running Windows 8, 10, 11 or Windows Server who heard about the Secure Boot certificate expiry and wants to know whether their machine is affected. ✗ Not for users replacing bootloaders this week (Linux, VeraCrypt, dual-boot) — the third-party certificate chain needs vendor-specific steps first.

TL;DR

• Microsoft UEFI CA 2011 (third-party boot software) expired June 27, 2026; Windows Production PCA 2011 (the Windows boot loader cert) expired October 19, 2026.
• Nothing stops booting: un-updated devices “continue to start and operate normally” (Microsoft) — but they stop receiving new early-boot security protections.
• The 2023 replacement certificates have ridden normal Windows Update since 2023 and are valid into 2039–2040.
• The 30-second check: msinfo32 → Secure Boot State, plus Windows Update kept current.

TOP PICKS — EDITOR TEAM

Windows 11 Pro OEM key BEST SELLER Best for: Secure Boot-ready upgrades and new installs	Check price ↗
Windows 11 Home key Best for: Home PCs that pass the Secure Boot/TPM check	Check price ↗
Windows 10 IoT Enterprise 2021 Best for: Fixed-purpose machines on the LTSC track	Check price ↗
Windows Server IoT 2022 Best for: Server and appliance builds	Check price ↗

Disclosure: links go to KeyStarter products; we may earn from qualifying purchases. Prices are set at checkout.

01What exactly expired in 2026?

Secure Boot works by checking the digital signature of everything that loads before Windows against certificates stored in the PC’s firmware (UEFI). Two of Microsoft’s signing certificates from 2011 have now run out: Microsoft UEFI CA 2011 on June 27, 2026, and Microsoft Windows Production PCA 2011 — the one that signs the Windows boot loader itself — on October 19, 2026.

The replacements have existed since 2023: Windows UEFI CA 2023 and companion 2023 certificates for third-party boot software, valid into 2039–2040. Microsoft announced the transition in June 2025 (KB5062710) and has shipped the new certificates through regular Windows Update channels for Windows 8, 10, 11 and Server ever since.

“Devices that haven’t received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install.”

— Microsoft, Windows Secure Boot certificate expiration and CA updates (KB5062710)

Bottom line. two 2011-era signing certificates hit their expiry dates in 2026 — and expiry is a maintenance deadline, not a kill switch.

02Is your PC actually affected?

If the machine has taken normal Windows updates since 2023, it almost certainly already trusts the 2023 certificates and nothing changes for you. The affected population is narrower: PCs that have been offline or frozen for years, machines with Windows Update broken, and some virtual machines or managed fleets that never received the rollout.

Microsoft's Secure Boot certificate expiration announcement, KB5062710 — Microsoft’s announcement KB5062710 (June 26, 2025) — the source for every date in this guide. (Screenshot: KeyStarter, captured Oct 27, 2026)

Bottom line. an internet-connected PC kept current through Windows Update is already carrying the 2023 certificates — the check in section 05 confirms it.

03What happens to a PC that never gets the 2023 certificates?

The failure mode is quiet. The old boot loader keeps passing signature checks against the old certificate in firmware, so the machine boots, runs and installs regular updates exactly as before — Microsoft says so explicitly. What it stops doing is receiving new protections for the early boot process: future DBX revocations (the mechanism that blocks bootkits like BlackLotus) and newly signed boot components can no longer be trusted by that firmware.

Device state after Oct 19, 2026	Boots?	Early-boot protections	What to do
Windows 10/11, updates current	Yes	Protected (2023 certs in place)	Nothing — confirm Secure Boot is on
Secure Boot turned off in firmware	Yes	Inactive — expiry is irrelevant	Re-enable in UEFI settings when convenient
Offline machine, missed the rollout	Yes	Frozen at the 2011 state	Get current via Windows Update once online
Third-party boot software (Linux, VeraCrypt)	Depends	Needs the 2023 KEK/option-ROM chain	Follow vendor guidance before changing anything

Windows 10 machines on Extended Security Updates are in the same boat as everyone else: the certificates shipped through the same update channels, so an ESU-enrolled machine that stays current is covered — our Windows 10 ESU enrollment guide covers that program’s deadlines separately.

Windows 10 Pro box: ESU-era machines ride the same update channels — Windows 10 machines receive the 2023 certificates through the same servicing channels as Windows 11 — no separate program to join.

Bottom line. nothing breaks on October 19 — the machine just quietly stops being protectable against future boot-level threats until it catches up.

04How do you get the 2023 certificates installed?

For a normal PC, the answer is: keep doing what you are doing. The certificates arrive as part of regular servicing updates from Windows Update — there is no separate purchase, license or download. The only real work is for machines that have drifted:

Bring the device current

1Connect to the internet and open Settings → Windows Update, then install everything offered until the page says you’re up to date.

2Reboot when asked — some servicing updates for the boot chain apply across restarts.

3For managed fleets, audit certificate state with Microsoft’s key creation and management guidance (linked in the references) instead of trusting one machine as proof.

Bottom line. Windows Update is the entire delivery mechanism — a current machine is a protected machine.

05How do you check Secure Boot on your own PC?

The 30-second check

1Press Win+R, type msinfo32 and press Enter.

2In System Summary, read the Secure Boot State line — On means Secure Boot is active.

3Open Settings → Windows Update → Update history and confirm recent servicing updates install without errors.

Windows does not show a plain “certificate version” screen, so the practical proof is the pair above: Secure Boot On plus a current update history means the machine is on the normal protected path. And because Secure Boot has been a Windows 11 requirement, any machine you are preparing for an upgrade should be checked first — our Windows 11 Pro key buying guide puts that check at step one of the upgrade. If a key is the missing piece, the Windows 11 Pro listing resolves it the same day. And check the OS version while you are at it — Windows 11 24H2 just ended updates for Home and Pro, a deadline our Windows 11 24H2 lifecycle guide explains.

Bottom line. msinfo32 plus update history answers the question in half a minute — no tools, no firmware digging.

Windows 11 Pro box: Secure Boot has been part of the Windows 11 hardware requirement — Secure Boot has been a Windows 11 hardware requirement from day one — verify it before any upgrade or new key.

06Frequently asked questions

Do I have to replace my PC because the Secure Boot certificates expired?

No. Microsoft states devices without the 2023 certificates continue to start and operate normally, and standard updates keep installing. The gap is only that early-boot security protections stop advancing until the device catches up via Windows Update.

My PC is offline most of the time — is it at risk?

It is in the main affected group: an offline machine may never have received the 2023 certificates. The exposure is modest for a machine that never touches untrusted networks or files, and one Windows Update session whenever it does go online closes the gap.

Does Secure Boot matter when buying a Windows 11 key?

Yes — Secure Boot (with TPM 2.0) is part of the Windows 11 hardware requirement, and the activation check is separate from it. If your PC passes, a matching key from our Windows 11 Pro listing activates the same day; the upgrade walkthrough in our buying guide starts with this exact check.

I dual-boot Linux — is anything different for me?

The third-party side of the chain (Microsoft UEFI CA 2011, expired June 27, 2026) is what signs many Linux bootloaders and tools like VeraCrypt. Moving to the 2023 certificates involves the KEK and option-ROM updates, so follow your distribution’s and vendor’s guidance before changing anything — do not treat this as a routine Windows Update.

External References

Written by the KeyStarter Editorial Team, with AI-assisted research; sources verified and linked above.