A relative forwards a headline saying Windows “Secure Boot certificates have expired” and asks whether the family laptop will stop starting. It will not. But the date is real: the last of Microsoft’s original 2011 Secure Boot certificates expired on October 19, 2026, and a PC that never received the 2023 replacements now misses a whole category of future security fixes. The check takes about a minute, and Windows Security will tell you which group your PC is in.
Which certificates expired, and when
Microsoft’s main Secure Boot certificate article (KB5062710) lists four 2011-era certificates and their 2023 replacements:
| Expired certificate | Expiration date | Replacement | What it does |
|---|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 | Signs updates to the Secure Boot allow and block lists |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 | Signs third-party boot loaders and EFI applications |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft Option ROM UEFI CA 2023 | Signs third-party option ROMs (firmware on add-in cards) |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 | Signs the Windows boot loader |
The October date is the one that matters most to Windows users, because it covers the certificate that signs Windows’ own boot loader. Microsoft’s replacement for it, Windows UEFI CA 2023, is what future Windows Boot Manager updates depend on, which is why a PC still holding only the 2011 set misses them.
Why this is in the news now
Two things happened in the past two weeks. The October 19 expiration passed, and on October 28 Microsoft’s Windows message center added a note to its monthly update announcement: “a limited number of consumer and business devices might experience one additional restart during installation,” a one-time restart after a Secure Boot certificate update is applied. The October preview update’s release notes (KB5127936) repeat that the certificates “started to expire in June 2026” and that updated certificates “will continue to be delivered through Windows Update in the coming months.” So the rollout is still going on after the deadline.
Check your PC in Windows Security
Since April 2026, according to Microsoft’s status article (KB5087130), the Windows Security app shows certificate status under Device security, then Secure Boot. One trap: Microsoft warns that “a green checkmark alone does not confirm your certificates are updated.” Read the sentence underneath it.
| Message you see | What it means | What to do |
|---|---|---|
| “Secure Boot is on and all required certificate updates have been applied.” | Fully updated | Nothing |
| “…using an older boot trust configuration that should be updated.” | Not yet updated | Install all Windows updates and restart when asked |
| “…affected by a known issue… temporarily paused” | Microsoft is holding the update for your model | Nothing; Microsoft says it resumes automatically |
| “…not yet enough data to classify your device” | Your model needs more validation | Microsoft points to aka.ms/getsecureboot |
| “…does not support the automated Secure Boot certificate update due to hardware or firmware limitations” | A firmware (BIOS/UEFI) update is likely needed | Check your PC maker’s support site |
| “…can no longer receive required updates for the Windows boot experience” | Still on old certificates after expiry | Follow aka.ms/getsecureboot; contact the maker |
If the app shows no certificate text at all, check whether Secure Boot is on. Microsoft’s home-user guidance (KB5062711) says: press Windows + R, type msinfo32, press Enter, and look for Secure Boot State. “On” is what you want.
Questions readers are asking
Will my PC stop booting? No, not because of the expiration itself. Microsoft’s article on what happens when the certificates expire (KB5079373) says the device “continues to start normally” and everyday apps, networking and browsing are unchanged.
So what do I actually lose? New Secure Boot and Boot Manager protections, fixes for early-boot vulnerabilities such as BitLocker bypass mitigations, and possibly updates to third-party components that rely on Microsoft’s Secure Boot trust. Microsoft says such a device “becomes progressively less protected” over time.
Can the update itself cause trouble? In rare cases, yes. The home-user article says that “in a few cases, your device might not start, or you might experience a BitLocker recovery situation when receiving the new certificates.” That is a good reason to find your BitLocker recovery key now, before you need it. If you do not know where it is, find out while the PC still works.
Should I turn off Secure Boot? No. Microsoft is blunt: Secure Boot “should not be disabled to work around certificate expiration.” The home-user page mentions disabling it only as a recovery step if a PC will not start after the update, and recommends talking to the manufacturer first.
What about Windows 10? The same article notes Windows 10 support ended on October 14, 2025, and points to the Extended Security Updates program to keep receiving security updates, Secure Boot included. Our Windows 10 options guide covers ESU and the alternatives.
A quick routine for the family PCs
- On each Windows PC, open Windows Security, Device security, Secure Boot, and read the status sentence.
- If it says “older boot trust configuration,” run Windows Update until nothing is left, then restart. A second restart during install is expected this month.
- If it mentions hardware or firmware limitations, look up a BIOS or UEFI update on the PC maker’s support page. Microsoft notes such updates “may only be available for devices that are still within their support period.”
- Write down where the BitLocker recovery key lives for each PC.
- If a PC sits at “Pending restart” for days, fix that first with our pending restart checklist.
Sources
- Microsoft Support: Windows Secure Boot certificate expiration and CA updates (KB5062710)
- Microsoft Support: When Secure Boot certificates expire on Windows devices (KB5079373)
- Microsoft Support: Secure Boot certificate update status in the Windows Security app (KB5087130)
- Microsoft Support: Windows devices for home users, businesses, and schools with Microsoft-managed updates (KB5062711)
- Microsoft Learn: Windows message center (Oct 28, 2026 entry)
Checked against Microsoft’s pages on November 2, 2026. Status wording in Windows Security may vary as Microsoft rolls out changes.